Expose shared session inactivity settings in Settings

[warp-agent-staging]

Description

Exposes the three existing shared-session (/remote-control) inactivity durations as user-configurable settings in Settings > Features > Session, below the existing "Confirm before closing shared session" toggle:

• Revoke edit access after being inactive for — inactivity_period_before_revoking_roles (default 10 min)
• Warn before ending the session after being inactive for — inactivity_period_before_warning (default 25 min)
• End the shared session after being inactive for — inactivity_period_before_ending_session (default 30 min)

No inactivity timeout behavior changes. Defaults are unchanged, the sharer inactivity ladder in app/src/terminal/view/shared_session/view_impl.rs is untouched, and what counts as "activity" is unchanged. This PR only surfaces existing knobs.

Linked Issue

Linear: APP-5313

Changes

• app/src/terminal/shared_session/settings.rs: the three settings move from private: true to private: false with a toml_path and user-facing description, following the same pattern as ShouldConfirmCloseSession.
• Three independent SettingsWidgets in app/src/settings_view/features_page.rs — SharedSessionRevokeEditAccessWidget, SharedSessionWarningWidget, SharedSessionEndSessionWidget — each a minute-based number input, each independently searchable (row-scoped search_terms), backed by its own editor field on FeaturesPageView.
• Each edit is validated to be a positive integer within a safe range and clamped on commit so the revoke ≤ warn ≤ end ordering always holds.

Response to review

An adversarial review surfaced five findings, all addressed in a follow-up commit:

1. Legacy values silently dropped. Flipping private: true → false meant existing users' custom values (stored under the old private keys) were never read from the new public location. Added a dedicated one-time migration (migrate_legacy_private_inactivity_settings, its own completion marker independent of the app's general SettingsFileMigrationComplete marker) that copies a private value across only when the public location doesn't already have one.
2. No cross-validation at the authoritative boundary. Added SharedSessionSettings::register_and_enforce_inactivity_ordering, which corrects out-of-order values at every point they become authoritative (initial load / hand-edited settings file, cloud sync, disk hot-reload), and changed the two derived-interval helpers to use saturating_sub as defense-in-depth against two latent underflow panics found in the ladder. The ordering comparison is isolated in a single ladder_phase_order_ok predicate so a possible future "zero disables this phase" change only has to touch that one place.
3. Overflow in minute parsing. parse_shared_session_inactivity_minutes now rejects any value above u64::MAX / 60, so the minutes→seconds conversion can't overflow.
4. Unfilterable mega-widget. Split the single combined widget into three independent SettingsWidgets with row-scoped search terms, verified with a StubWidget-based filter test plus live search in the running app (see screenshots).
5. Redundant doc comments — resolved by construction: the widget split removed the standalone Action enum those comments were attached to.

Testing

• cargo build --bin warp — passes.

• cargo fmt -- --check and cargo clippy -p warp --bin warp --all-targets -- -D warnings — pass.

• cargo test -p warp --lib schema_validation_tests — passes.

• cargo nextest run -p warp shared_session:: settings_view:: — 448 passed, including new tests for: legacy-migration survival / no-clobber / idempotency, ordering correction from storage and from cloud sync, a pure saturating_sub regression test, minute-parsing bounds (including the overflow case), clamp correctness/idempotency, and a filter test proving the three rows are independently searchable.

• Manually verified end-to-end with computer use on a freshly built and launched instance (to rule out testing a stale running build): all three rows render under Features > Session with correct labels/descriptions/defaults; searching "revoke" now matches only the Revoke row, "disconnect" matches only the End row, and "inactivity" (a term shared by all three) matches all three; an edit to "Revoke edit access" persists across closing/reopening Settings; and setting it to "999" gets clamped down to the current Warn value rather than accepted as-is.

• I have manually tested my changes locally with computer use (equivalent to ./script/run)

Screenshots / Videos

Computer-use screenshots (7)

Features > Session settings showing the three new shared-session inactivity rows with their labels, minute inputs, and description texts.

Close-up after editing "Revoke edit access after being inactive for", confirming the edit takes.

Features > Session on a freshly rebuilt instance: Revoke edit access (25 min), Warn before ending (25 min), End the shared session (30 min).

Settings search for "revoke" on the fresh build shows only the "Revoke edit access after being inactive for" row (Features (1)) — confirms the widget-split fix (review finding 4).

Settings search for "disconnect" on the fresh build shows only the "End the shared session after being inactive for" row (Features (1)).

After entering 999 for "Revoke edit access after being inactive for" and reopening Settings, the value shows 25 (clamped to the current Warn ceiling) rather than 999.

Clamping test result from the initial verification pass, consistent with the fresh-build result above.

Agent Mode

• Warp Agent Mode - This PR was created via Warp's AI Agent Mode

CHANGELOG-IMPROVEMENT: You can now customize how long a shared session can sit idle before edit access is revoked, a warning is shown, and the session ends, in Settings > Features > Session.

Conversation: https://staging.warp.dev/conversation/62aa162e-53df-4eac-8b9e-da340c2d3b08
Run: https://oz.staging.warp.dev/runs/019ff20d-8301-756e-b971-2365db195c8a

This PR was generated with Oz.