fix(dialogs): Enter presses the highlighted button in every dialog - #2782

…leanup

* origin/main:
  feat(terminal): add an Option as Meta key setting on macOS (#2850)
  fix(agents): restrict workflow requests in bb-block only (#2518)
  fix(dialogs): Enter presses the highlighted button in every dialog (#2782)
  Polish Compact messages and conversation appearance settings (#2863)
  fix(composer): let Option+Up/Down switch conversations from an empty composer (#2832)
  fix(reactions): Scope timed reactions to the selected video (#2796)
  fix(communities): name what the Join dialog is doing instead of "Working…" (#2822)
  docs(agents): explain the per-conversation MCP cost of Claude agents (#2683)
  fix(avatars): keep unsaved avatar drafts and focus, and validate the URL late (#2714)
  fix(agents): offer stream and forum connection setup only to channel members (#2749)
  Describe Attention as what the agent does, not its tools (#2865)
  Let a local Codex agent join its owner's huddle by voice (#2321)
  ci: give the native job room for a cold Rust cache (#2867)
  fix(pairing): refuse unknown communities natively and name the requesting process (#2835)
  Add per-interest Attention pause and management controls (#2847)
  feat(drafts): show where unsent drafts wait (#2853)

# Conflicts:
#	.github/workflows/release.yml

…-buzz-branding

* origin/main: (385 commits)
  fix(communities): let Cancel, × and Escape leave a Join lookup and name the host that didn't answer (#2821)
  fix(agents): let watches hear public channels the agent is not in (#1854)
  Preview and send Drafts & sent in place, with a shared count bubble (#2833)
  feat(terminal): add an Option as Meta key setting on macOS (#2850)
  fix(agents): restrict workflow requests in bb-block only (#2518)
  fix(dialogs): Enter presses the highlighted button in every dialog (#2782)
  Polish Compact messages and conversation appearance settings (#2863)
  fix(composer): let Option+Up/Down switch conversations from an empty composer (#2832)
  fix(reactions): Scope timed reactions to the selected video (#2796)
  fix(communities): name what the Join dialog is doing instead of "Working…" (#2822)
  docs(agents): explain the per-conversation MCP cost of Claude agents (#2683)
  fix(avatars): keep unsaved avatar drafts and focus, and validate the URL late (#2714)
  fix(agents): offer stream and forum connection setup only to channel members (#2749)
  Describe Attention as what the agent does, not its tools (#2865)
  Let a local Codex agent join its owner's huddle by voice (#2321)
  ci: give the native job room for a cold Rust cache (#2867)
  fix(pairing): refuse unknown communities natively and name the requesting process (#2835)
  Add per-interest Attention pause and management controls (#2847)
  feat(drafts): show where unsent drafts wait (#2853)
  feat(agents): let app-hosted agents read their owner's channels and members (#2745)
  ...

# Conflicts:
#	src/bundled/builderlab/README.md
#	src/bundled/builderlab/oauth/browser.test.ts
#	src/bundled/builderlab/oauth/browser.ts

…ion-and-status

* origin/main: (37 commits)
  fix(browser-host): use the Buzz login variant for dev Builderlab sign-in (#2222)
  refactor(plugin-manager): move distributor values into build settings (#2649)
  fix(communities): let Cancel, × and Escape leave a Join lookup and name the host that didn't answer (#2821)
  fix(agents): let watches hear public channels the agent is not in (#1854)
  Preview and send Drafts & sent in place, with a shared count bubble (#2833)
  feat(terminal): add an Option as Meta key setting on macOS (#2850)
  fix(agents): restrict workflow requests in bb-block only (#2518)
  fix(dialogs): Enter presses the highlighted button in every dialog (#2782)
  Polish Compact messages and conversation appearance settings (#2863)
  fix(composer): let Option+Up/Down switch conversations from an empty composer (#2832)
  fix(reactions): Scope timed reactions to the selected video (#2796)
  fix(communities): name what the Join dialog is doing instead of "Working…" (#2822)
  docs(agents): explain the per-conversation MCP cost of Claude agents (#2683)
  fix(avatars): keep unsaved avatar drafts and focus, and validate the URL late (#2714)
  fix(agents): offer stream and forum connection setup only to channel members (#2749)
  Describe Attention as what the agent does, not its tools (#2865)
  Let a local Codex agent join its owner's huddle by voice (#2321)
  ci: give the native job room for a cold Rust cache (#2867)
  fix(pairing): refuse unknown communities natively and name the requesting process (#2835)
  Add per-interest Attention pause and management controls (#2847)
  ...

# Conflicts:
#	docs/buzz-help.md

**Category:** fix
**User Impact:** Dialogs keep Cancel secondary while a visible ring
shows which button Enter will activate.

**Problem:** #2782 used prominent styling for several focused Cancel
actions, making keyboard position compete with the dialog’s action
hierarchy. Some confirmations also fell back to header Close while
others explicitly focused Cancel.

**Solution:** Restore the action/Cancel styling pairs, make safe
confirmation defaults explicit, and show a shared 2px focus outline with
a 2px gap on focused dialog Buttons, including pointer-opened autofocus.
Simple confirmations generally focus Cancel unless they intentionally
default to the primary action. Gated confirmations start at their
required field; focused header, body and footer buttons all retain the
ring, including split-button halves. Tab order and activation handlers
are preserved; the ring fits the footer’s existing 4px allowance, so
footer height, scrolling and click-through behavior stay intact.

Follow-up to #2782. Shared owners: Button/IconButton styling in
`components.css`, existing Dialog/AlertDialog focus management, and
existing footer geometry in `overlays.css`.

<details>
<summary>File changes</summary>

**docs/buzz-help.md**
Explain how the focus ring, Enter/Space and filled action styling
relate.

**src/app/AgentPluginRequests.tsx**
Keep Cancel secondary when enabling a requested plugin.

**src/app/CommunityDepartureSettings.tsx**
Restore secondary Cancel and prominent Remove while retaining
destructive Leave.

**src/app/ExternalIdentityAuthorization.tsx**
Give Authorize its action emphasis while Cancel keeps initial focus.

**src/bundled/agents/AgentsPage.test.tsx**
Update the existing Bestie removal assertion to secondary Cancel.

**src/bundled/agents/BestieChoice.tsx**
Restore the action hierarchy in remote Bestie and removal confirmations.

**src/bundled/bestie/BestieChooser.test.tsx**
Verify Cancel-first activation independently of the action’s prominence.

**src/bundled/builderlab/communities/HostedCommunities.tsx**
Explicitly focus Cancel for caution prompts and the required fields for
permanent deletion and ownership transfer; preserve the normal action
hierarchy.

**src/bundled/channels/ChannelGeneralAccess.tsx**
Keep Cancel secondary and Change access prominent.

**src/bundled/channels/ChannelLifecycleDialog.tsx**
Keep Archive prominent and its initially focused Cancel secondary.

**src/bundled/channels/ChannelLifecycleMenu.test.tsx**
Update Archive’s existing variant expectations without changing focus
expectations.

**src/bundled/channels/ChannelMembersDialog.tsx**
Restore Share’s prominence while Cancel retains initial focus.

**src/bundled/github/PullChecklist.tsx**
Keep Cancel secondary in merge/queue confirmation; retain the bypass
attention treatment.

**src/features/communities/CommunityPicker.tsx**
Restore prominent Remove in the failed-leave fallback while Cancel stays
secondary.

**src/features/credential-pairing/PairingPrompt.tsx**
Keep Deny secondary and initially focused, with Allow prominent.

**src/features/messages/MessageComposer.test.tsx**
Update the existing Don’t bring assertion and retain its Enter
cancellation coverage.

**src/features/messages/useBringAgents.tsx**
Keep Don’t bring secondary while Bring and Send retain action emphasis.

**src/shared/design-system/DESIGN.md**
Document the 2px outline/2px gap, dialog-wide focus visibility,
Cancel-first simple confirmations and field-first gated confirmations.

**src/shared/design-system/styles/components.css**
Show the shared Button focus ring inside dialogs after pointer or
keyboard entry and keep focused split-button halves above their
neighbour, within the existing 4px allowance.

**src/shared/design-system/styles/globals.css**
Clarify the modal exception in the existing modality-reset comment.

**tests/browser/channel-archive-delete-pane.spec.mjs**
Update the existing Archive action hierarchy assertion.

**tests/browser/channel-lifecycle.spec.mjs**
Extend the pointer-opened Archive journey to assert visible focus,
secondary Cancel and prominent Archive.

**tests/fixtures/design-system/viewer.spec.ts**
Clarify the focus-helper comment for ordinary controls outside dialogs.

**src/app/ManagedPlugins.tsx**
Start plugin access review on its Cancel/Close action rather than header
Close.

**src/app/ManagedPlugins.test.tsx**
Check initial Cancel focus in the existing cancellation/discard test.

**src/bundled/agents/AgentSettingsHost.tsx**
Start the harness-migration confirmation on Cancel.

**src/bundled/agents/AgentSettingsHost.test.tsx**
Check Cancel focus before explicitly continuing the migration.

**src/bundled/builderlab/communities/HostedCommunities.test.tsx**
Use one dedicated permanent-deletion focus test, check recipient-field
focus, and retain archive/unarchive default checks.

**src/features/agents/AgentManage.tsx**
Start agent deletion and community removal on Cancel.

**src/features/agents/AgentManage.test.tsx**
Verify Enter cancels delete/remove, restores focus and calls neither
operation.

**src/features/identity/identity.test.tsx**
Verify initial focus stays in the masked key field in the existing
sign-out safety-gate test.

**src/features/solo/ConvertToChannel.tsx**
Start conversion on Cancel, retaining its existing save and recovery
behavior.

**src/features/solo/ConvertToChannel.test.tsx**
Verify Enter cancels conversion without publication or project unfiling.

</details>

### Reproduction steps

1. Open a channel’s Archive confirmation with the pointer. Cancel should
be secondary, initially focused and visibly ringed; Archive should
remain filled.
2. Press Enter on Cancel to dismiss without archiving. Reopen and press
Tab: the same ring should move to Archive. Escape should dismiss and
restore focus.
3. Open Delete, Leave, Unarchive, Share access and a dirty-form discard
guard. The action hierarchy should stay distinct from the existing focus
target.
4. Open Delete agent, Remove agent, or Convert to channel. Cancel should
receive initial focus; Enter should dismiss without performing the
operation.
5. In the desktop app, inspect Bestie replacement/private-channel access
and Start huddle. Their established action-first defaults remain
unchanged; cancel the confirmations after inspecting them.

### Validation

- At head `bd85cfc1f45d0901eb6766039da7dbcc5064f662`, mandatory push
checks passed: types/related unit tests, design guards, Rust Clippy and
policy checks.
- Full `channel-lifecycle.spec.mjs` and `sidebar-geometry.spec.mjs`,
Chromium and WebKit, one worker, no retries or measurement dependencies:
**28 passed**. The existing pointer-opened Archive journey checks
visible focus and action hierarchy. The previously failing sidebar
geometry assertion passes after integrating main’s #2946 fix. No browser
cases were added or removed; the extra top-edge geometry assertion was
removed because ring/footer dimensions are unchanged at the agreed
2px/2px footprint.
- Permanent deletion initial focus is checked in one dedicated test,
independent of the deletion-recovery helper. Hosted transfer starts in
the recipient field; the existing sign-out safety-gate test starts in
its masked key field. Submission gates and activation handlers are
unchanged.
- Earlier exact-style lifecycle checks passed **36 cases** including
configured measurement dependencies; footer/action regressions passed
**72**, with **2 unsupported WebKit media emulations skipped**. Earlier
design-system unit validation passed **29 files / 205 tests**.
- The earlier full-root Vitest run had 1,020 passing files and two stale
Bestie assertions; after correction that complete BestieChooser file
passed **10/10**. A later all-green full-root run is not claimed.
- Hosted CI for the updated head is running; local success is not a
green hosted-CI claim. Native acceptance and the runtime coverage gaps
below remain explicit.

### Capture coverage and remaining gaps

**32 real-product captures below; this is not exhaustive runtime
coverage.** The 104 source seed sites include wrappers and forms that
initially focus inputs. Ordinary search/name/link/model/status fields,
selected radios and static headings are outside the Button screenshot
count. Wrapper/caller expansion and the broader imperative-focus
inventory remain incomplete.

Missing prerequisites / blocked states:

- Agent plugin enable/delete requests, external identity/app
authorization, credential pairing, legacy import, identity backup
consent and account-conflict onboarding need genuine pending requests or
account states absent from this test run.
- External plugin review/install/update/error/unchanged/rollback/delete
modes need the native import service and suitable external plugin
versions; the browser catalog is bundled-only.
- Remote-first-Bestie needs no explicitly saved Bestie, and global
Bestie removal needs the absent mainAgent account capability. The saved
preference was retained.
- Hosted-community archive/delete/transfer needs a signed-in Builderlab
account and eligible community. The native test build offers Sign in.
- Moderation and relay staff need unavailable relay capabilities;
membership administration requires an owner/admin community.
Provider/onboarding autofocus states require native provider or identity
setup.
- Structured diff, huddle-image, Canvas conflict/history, watches,
workflow/webhook notices and cross-community message-preflight variants
need suitable source data or an enabled plugin. No audio session, merge,
credential approval or provider/account reset was performed for
coverage.

Still unexercised, rather than counted as blocked or complete:
additional native agent
browse/card/avatar/migration/import/team/history/removal/discard
surfaces; sign-out guard; disabled Focus/Todos/Workflows/Pi plugin
flows; Public access destination; former-Bestie and recovery variants;
workspace/draft callers; conversation overlay contributions; four direct
provider/sign-in `autoFocus` Buttons. Settings departure was captured;
the separate picker failure fallback was not.

Human-approved capture scope: current host appearance at normal desktop
width, without a theme/width/text-size matrix. Browser captures use the
browser’s current appearance; native captures use the desktop app’s
current appearance. The pointer-focused member-role split button is from
`bd85cfc1f`. Its real browser check confirms pointer modality, `:focus`
without `:focus-visible`, a 2px outline/2px offset and stacking above
its neighbour; only the role menu was toggled, with no membership
change. The Cancel-focus captures for Delete agent and Convert to
channel are from `13f8ec1e3`. Unchanged-surface captures remain from
`0e0bdb18a`, except Bestie replacement and Unarchive, captured during
the identical 2px/2px styling iteration before its commit. Screen-reader
announcements were not tested.

### Screenshots / demos

Actual running app on disposable review data, not fixtures or component
viewers. Native snapshots are shown at logical display size.
Control/footer crops omit profile content, host URLs or private channel
names; no pixels were composited into product surfaces.

#### Channel lifecycle

| Surface | Capture |
| --- | --- |
| Archive — initial Cancel | ![Archive — initial
Cancel](https://github.com/user-attachments/assets/49cd1b0d-4fe9-4adb-bcc0-a5f420591298)
|
| Archive — Tab to action | ![Archive — Tab to
action](https://github.com/user-attachments/assets/48815d85-4e92-4e50-8605-808ae5765f47)
|
| Delete — initial Cancel | ![Delete — initial
Cancel](https://github.com/user-attachments/assets/3ad3b4f8-0f6c-439d-b60d-36b7ff370ae8)
|
| Delete — Tab to destructive action | ![Delete — Tab to destructive
action](https://github.com/user-attachments/assets/961f6b0b-7c5b-4507-85b8-83cc19bac38c)
|
| Leave channel | ![Leave
channel](https://github.com/user-attachments/assets/6b0ba322-ff6c-45d0-8c8a-109baccf426e)
|
| Unarchive |
![Unarchive](https://github.com/user-attachments/assets/fb33663b-ff55-4d39-8840-7f1feaf60773)
|
| Hide conversation | ![Hide
conversation](https://github.com/user-attachments/assets/f15e2527-baa1-421a-987d-a70d57570ca3)
|


#### Channel creation, access and discard

| Surface | Capture |
| --- | --- |
| Member-role split button — pointer focus | ![Member-role split button
— pointer
focus](https://github.com/user-attachments/assets/79b5609d-2c92-492a-96a3-50c8e7b25058)
|
| Make private | ![Make
private](https://github.com/user-attachments/assets/0199830a-ade5-4f5d-930e-2319081116b2)
|
| Make public | ![Make
public](https://github.com/user-attachments/assets/30740f7f-49d0-4ecc-b9e9-79b1bcc7760c)
|
| Creation discard | ![Creation
discard](https://github.com/user-attachments/assets/3dd124a5-ad09-4b9d-a08e-fbe28eb67a39)
|
| Edit-channel discard | ![Edit-channel
discard](https://github.com/user-attachments/assets/f89dadb1-2b31-4c59-b5a5-58f57d572579)
|
| Access: Private | ![Access:
Private](https://github.com/user-attachments/assets/35a7bae2-581d-4888-ada6-409ca83089f9)
|
| Access: View only | ![Access: View
only](https://github.com/user-attachments/assets/86565636-4374-4b5b-a594-5c5c317a44ee)
|
| Share access — Cancel | ![Share access —
Cancel](https://github.com/user-attachments/assets/67036510-e3c4-4625-809b-a666c76d6ba8)
|
| Template discard | ![Template
discard](https://github.com/user-attachments/assets/f5f736f3-b39f-4805-94cb-bc35abffe27f)
|
| Remove empty review section | ![Remove empty review
section](https://github.com/user-attachments/assets/f7837c3f-cd7d-48cb-a537-8ad0cd172981)
|


#### Settings and community departure

| Surface | Capture |
| --- | --- |
| Settings Close — control crop | ![Settings Close — control
crop](https://github.com/user-attachments/assets/c46bcc29-21aa-4f23-91d7-85519014dc4d)
|
| Plugin-details Close — control crop | ![Plugin-details Close — control
crop](https://github.com/user-attachments/assets/04ec5f3a-9ac7-4971-8d6d-e37331513d6e)
|
| Settings discard | ![Settings
discard](https://github.com/user-attachments/assets/e16b9d5c-aa75-4364-9441-996f7f4eee8d)
|
| Leave community — footer crop | ![Leave community — footer
crop](https://github.com/user-attachments/assets/cafc04c6-d91c-4cc7-8311-023c6c5eb3b0)
|
| Remove community — footer crop | ![Remove community — footer
crop](https://github.com/user-attachments/assets/14146c9d-7c91-4785-bca6-e6087b265c0b)
|


#### Native agent and huddle surfaces

| Surface | Capture |
| --- | --- |
| Bestie replacement | ![Bestie
replacement](https://github.com/user-attachments/assets/c5d6d8f7-f3a3-405e-b4c3-34748c16febc)
|
| Remove private-channel access — footer crop | ![Remove private-channel
access — footer
crop](https://github.com/user-attachments/assets/f0e1cc3a-7727-4858-9c95-19993903eb68)
|
| Add private-channel access | ![Add private-channel
access](https://github.com/user-attachments/assets/000ad5b9-482f-4c84-832e-7b2c733f2486)
|
| Delete agent — Cancel focus | ![Delete agent — Cancel
focus](https://github.com/user-attachments/assets/3a06b7e2-8963-4b65-81af-dea73694b9b2)
|
| Start huddle — initial action | ![Start huddle — initial
action](https://github.com/user-attachments/assets/8f0ddd17-d81f-4cd8-a2f6-c5d2de5bfcf4)
|


#### Other dialog Close and cancellation paths

| Surface | Capture |
| --- | --- |
| Feedback — Close focus | ![Feedback — Close
focus](https://github.com/user-attachments/assets/956b1e31-b710-4309-a191-7d64125d0619)
|
| Mermaid — Close focus | ![Mermaid — Close
focus](https://github.com/user-attachments/assets/5f0e74db-aa01-48ea-9727-abcf8f3e9b04)
|
| Delete message — Cancel | ![Delete message —
Cancel](https://github.com/user-attachments/assets/9aa422cb-96fd-4f63-8e87-58dde0340ee9)
|
| Chat settings — Close focus | ![Chat settings — Close
focus](https://github.com/user-attachments/assets/83c0365d-509d-40b0-9890-482314c23108)
|
| Convert to channel — Cancel focus | ![Convert to channel — Cancel
focus](https://github.com/user-attachments/assets/1e368707-d9c6-446c-bfd1-3cd8b257a1bc)
|

---------

Signed-off-by: Taylor Ho <[email protected]>
Co-authored-by: Carl <acda9e433d19dcd0e6b6840f7f4b98f3a56f1fab98049d444c087019e6d36560@feedback.communities.buzz.xyz>

Kyle's review: removing the only member on the last page clamps the list
back a page, but the hand-off used the row's index on the shown page, so
focus landed on that page's first member rather than the one just before
the removed member. The hand-off now remembers the members beside it in
the whole list and focuses the next, then the previous, by identity; the
index is only a fallback.

Also expect the Viewing only step to open on its action, as #2782 made
reversible changes do, in the later-page journey.

Kyle's review: removing the only member on the last page clamps the list
back a page, but the hand-off used the row's index on the shown page, so
focus landed on that page's first member rather than the one just before
the removed member. The hand-off now remembers the members beside it in
the whole list and focuses the next, then the previous, by identity; the
index is only a fallback.

Also expect the Viewing only step to open on its action, as #2782 made
reversible changes do, in the later-page journey.