[multi-team P7a] Scope default host slug and agent attribution to the window's team

Migrates two settings getters off the ambient `current_workspace().settings`
read onto `TeamScope`:

- `agent_attribution_setting_for_scope` replaces `get_agent_attribution_setting`,
  resolved fresh at render from the settings page's window.
- `default_host_slug_for_scope` replaces the windowed uses of
  `default_host_slug`, resolved from the cloud-mode input's window and
  re-resolved when that window's team changes.
- `any_team_has_default_host_slug` answers the windowless `/host` gate
  explicitly across every team, since that data source is shared with the TUI.

`is_invite_link_enabled` and `is_discoverable` are untouched: they are
genuinely workspace-only and have no `TeamSettings` equivalent.

Author: warp-agent-staging[bot]

app/src/ai/orchestration/providers.rs

@@ -87,6 +87,12 @@ pub fn first_filtered_model_id(harness_type: &str, ctx: &AppContext) -> Option<S
 /// Resolves the workspace-configured default host slug, honoring the
 /// `WARP_CLOUD_MODE_DEFAULT_HOST` env var override for developer
 /// testing. Mirrors the single-agent ambient flow.
+///
+/// Still reads ambient workspace settings rather than the window's team. Every consumer of
+/// this chain — the plan card, the confirmation card, the TUI orchestration block, and the
+/// handoff pipeline — has to move together, and two of them need decisions this function
+/// cannot make on its own: the TUI has no window to scope to, and the handoff bakes the host
+/// into a cloud run's config, which pins rather than resolves late.
 pub fn resolve_default_host_slug(ctx: &AppContext) -> Option<String> {
     if let Ok(slug) = std::env::var(DEFAULT_HOST_ENV_VAR) {
         let trimmed = slug.trim();
@@ -95,7 +101,7 @@ pub fn resolve_default_host_slug(ctx: &AppContext) -> Option<String> {
         }
     }
     UserWorkspaces::as_ref(ctx)
-        .default_host_slug()
+        .unscoped_default_host_slug()
         .map(str::to_string)
         .filter(|s| !s.trim().is_empty())
 }

app/src/settings/ai.rs

@@ -2069,8 +2069,8 @@ define_settings_group!(AISettings, settings: [
 
     // Whether Oz should add attribution (co-author line) to commit messages and PRs.
     // This is the user-level preference; it may be overridden by the team-level
-    // `enable_warp_attribution` AdminEnablementSetting (see
-    // `UserWorkspaces::get_agent_attribution_setting`).
+    // `enable_warp_attribution` AdminEnablementSetting of the window's team (see
+    // `UserWorkspaces::agent_attribution_setting_for_scope`).
     agent_attribution_enabled: AgentAttributionEnabled {
         type: bool,
         default: true,

app/src/settings_view/warp_agent_page.rs

@@ -1994,7 +1994,7 @@ impl WarpAgentPageView {
 
         categories.push(Category::new(
             "Agent Attribution",
-            vec![Box::new(AgentAttributionWidget::default())],
+            vec![Box::new(AgentAttributionWidget::new(ctx))],
         ));
 
         #[cfg_attr(not(feature = "local_fs"), allow(unused_mut))]
@@ -4169,9 +4169,18 @@ pub(crate) fn derive_agent_attribution_toggle_state(
     }
 }
 
-#[derive(Default)]
 struct AgentAttributionWidget {
     toggle: SwitchStateHandle,
+    view_handle: WeakViewHandle<WarpAgentPageView>,
+}
+
+impl AgentAttributionWidget {
+    fn new(ctx: &ViewContext<WarpAgentPageView>) -> Self {
+        Self {
+            toggle: Default::default(),
+            view_handle: ctx.handle(),
+        }
+    }
 }
 
 impl SettingsWidget for AgentAttributionWidget {
@@ -4190,7 +4199,16 @@ impl SettingsWidget for AgentAttributionWidget {
         let ai_settings = AISettings::as_ref(app);
         let is_any_ai_enabled = ai_settings.is_any_ai_enabled(app);
 
-        let org_setting = UserWorkspaces::as_ref(app).get_agent_attribution_setting();
+        // Whether this toggle is locked is live policy, so it is resolved from the window
+        // being painted rather than captured when the page was built: moving the window to a
+        // team with a different attribution policy has to change the toggle on the next
+        // frame. A page rendered outside any window has no team to read, so the user keeps
+        // control of their own preference.
+        let workspaces = UserWorkspaces::as_ref(app);
+        let org_setting = workspaces
+            .team_context(&self.view_handle, app)
+            .map(|scope| workspaces.agent_attribution_setting_for_scope(&scope))
+            .unwrap_or_default();
         let state = derive_agent_attribution_toggle_state(
             &org_setting,
             *ai_settings.agent_attribution_enabled,

app/src/terminal/input.rs

@@ -407,6 +407,33 @@ pub fn get_input_box_top_border_width() -> f32 {
     }
 }
 
+/// The cloud-mode host `ctx`'s window should default to: the `WARP_CLOUD_MODE_DEFAULT_HOST`
+/// developer override when set, otherwise the default host configured for that window's team.
+///
+/// Re-run on every team change rather than captured once, so a window that moves to a team
+/// with a different self-hosted default picks that up instead of keeping the host it opened
+/// with. The scope it mints is consumed here and never stored, so nothing can go stale
+/// between the read and its use.
+///
+/// Resolves through the `ViewContext`'s window rather than a [`WeakViewHandle`], which is the
+/// one shape available at both call sites: the first read happens while `Input` is still being
+/// constructed, and a view is not in `view_to_window` until construction finishes, so a handle
+/// would resolve no window and silently drop the team's host. Cross-window tab drag still does
+/// not re-resolve, because no signal for it exists yet (tracked on REV-2205).
+fn effective_default_host(ctx: &ViewContext<Input>) -> Option<String> {
+    if let Some(slug) = std::env::var("WARP_CLOUD_MODE_DEFAULT_HOST")
+        .ok()
+        .filter(|slug| !slug.is_empty())
+    {
+        return Some(slug);
+    }
+    let workspaces = UserWorkspaces::as_ref(ctx);
+    let scope = workspaces.team_context_for_operation(ctx);
+    workspaces
+        .default_host_slug_for_scope(&scope)
+        .map(String::from)
+}
+
 pub const COMPLETIONS_MENU_WIDTH: f32 = 330.;
 pub const OPEN_COMPLETIONS_KEYBINDING_NAME: &str = "input:open_completion_suggestions";
 pub const INPUT_A11Y_LABEL: &str = "Command Input.";
@@ -2335,15 +2362,7 @@ impl Input {
     ) -> ViewHandle<HostSelector> {
         let view = ctx
             .add_typed_action_view(|ctx| HostSelector::new(menu_positioning_provider.clone(), ctx));
-        // Env var takes priority over workspace setting for developer testing.
-        let effective_host = std::env::var("WARP_CLOUD_MODE_DEFAULT_HOST")
-            .ok()
-            .filter(|s| !s.is_empty())
-            .or_else(|| {
-                UserWorkspaces::as_ref(ctx)
-                    .default_host_slug()
-                    .map(String::from)
-            });
+        let effective_host = effective_default_host(ctx);
         if let Some(slug) = &effective_host {
             view.update(ctx, |selector, ctx| {
                 selector.set_default_host(slug.clone(), ctx);
@@ -2376,22 +2395,24 @@ impl Input {
                 });
             }
         });
-        // Keep the host selector and view model in sync when workspace metadata refreshes (e.g.
-        // admin changes default_host_slug).
+        // Keep the host selector and view model in sync when the host this window should
+        // default to changes: because the admin edited the team's `default_host_slug`, or
+        // because the window moved to a team that configures a different one.
         let view_for_ws = view.clone();
         let vm_for_ws = view_model.clone();
         ctx.subscribe_to_model(&UserWorkspaces::handle(ctx), move |_me, _, event, ctx| {
-            if !matches!(event, UserWorkspacesEvent::TeamsChanged) {
+            // Windows are independent, so a sibling window switching team must not retarget
+            // this one.
+            let affects_this_window = matches!(event, UserWorkspacesEvent::TeamsChanged)
+                || matches!(
+                    event,
+                    UserWorkspacesEvent::WindowTeamChanged { window_id }
+                        if *window_id == ctx.window_id()
+                );
+            if !affects_this_window {
                 return;
             }
-            let effective_host = std::env::var("WARP_CLOUD_MODE_DEFAULT_HOST")
-                .ok()
-                .filter(|s| !s.is_empty())
-                .or_else(|| {
-                    UserWorkspaces::as_ref(ctx)
-                        .default_host_slug()
-                        .map(String::from)
-                });
+            let effective_host = effective_default_host(ctx);
             if let Some(slug) = &effective_host {
                 view_for_ws.update(ctx, |selector, ctx| {
                     selector.set_default_host(slug.clone(), ctx);

app/src/terminal/input/slash_commands/data_source/core.rs

@@ -420,12 +420,15 @@ pub trait SlashCommandDataSource {
 
     fn common_command_gates(&self, ctx: &AppContext) -> CommonCommandGates {
         let ai_settings = AISettings::as_ref(ctx);
-        // Hide /host when no default host is configured (env var or workspace setting).
+        // Hide /host when no default host is configured (env var or team setting). This data
+        // source is shared with the TUI and runs on a `ModelContext`, so it has no window to
+        // scope the read to; it asks the cross-team availability question instead, and the
+        // command itself resolves the window's own host when it runs.
         let has_default_host = std::env::var("WARP_CLOUD_MODE_DEFAULT_HOST")
             .ok()
             .filter(|s| !s.is_empty())
             .is_some()
-            || UserWorkspaces::as_ref(ctx).default_host_slug().is_some();
+            || UserWorkspaces::as_ref(ctx).any_team_has_default_host_slug();
         CommonCommandGates {
             is_orchestration_enabled: ai_settings.is_orchestration_enabled(ctx),
             is_cloud_handoff_enabled: ai_settings.is_cloud_handoff_enabled(ctx),

app/src/workspaces/user_workspaces.rs

@@ -39,10 +39,10 @@ use crate::settings::{
     AISettings, AISettingsChangedEvent, CodeSettings, CodeSettingsChangedEvent, PrivacySettings,
 };
 #[cfg(test)]
-use crate::workspaces::workspace::{AIAutonomyPolicy, WorkspaceMember, WorkspaceSettings};
+use crate::workspaces::workspace::{AIAutonomyPolicy, WorkspaceMember};
 use crate::workspaces::workspace::{
     AiAutonomySettings, AiOverages, PurchaseAddOnCreditsPolicy, SandboxedAgentSettings,
-    UsageBasedPricingSettings,
+    UsageBasedPricingSettings, WorkspaceSettings,
 };
 
 const STRIPE_SUBSCRIPTION_INTERVAL_PAGE_PREFIX: &str = "/upgrade";
@@ -185,10 +185,6 @@ pub struct CreateTeamResponse {
 /// [`TeamScope`]'s contract. Code with no window at all (e.g. background GEAP token refresh)
 /// is not this type's job -- it needs its own accessor that reads across every one of the
 /// user's teams explicitly, in the shape of `UserWorkspaces::teams_allow_codebase_context`.
-// Nothing constructs or consumes one outside this module's own tests yet; remove this
-// `#[allow(dead_code)]`, and widen visibility to `pub`, once a Group 1 migration PR has a real
-// call site.
-#[allow(dead_code)]
 pub(crate) struct TeamContextForOperation {
     team_uid: Option<ServerId>,
 }
@@ -208,9 +204,6 @@ pub(crate) struct TeamContextForOperation {
 /// workspace-level data. Code with no window at all must not construct a scope to route around
 /// this; it should read across every team explicitly, the way
 /// `UserWorkspaces::teams_allow_codebase_context` does.
-// Only tests call `team_uid()` today; remove this `#[allow(dead_code)]` once a Group 1
-// migration PR has a real getter generic over this trait.
-#[allow(dead_code)]
 pub(crate) trait TeamScope {
     fn team_uid(&self) -> Option<ServerId>;
 }
@@ -241,9 +234,6 @@ impl TeamContextForOperation {
 /// a [`TeamContextForOperation`]. A [`WeakViewHandle`] locates a window to read from; it is
 /// not evidence that the holder is running in that window, which is what minting operation
 /// scope requires.
-// Only tests construct one today; remove this once a Group 1 migration PR resolves one from a
-// real render.
-#[allow(dead_code)]
 pub(crate) struct TeamContext<'a> {
     team_uid: Option<&'a ServerId>,
 }
@@ -451,8 +441,6 @@ impl UserWorkspaces {
     /// [`TeamContextForOperation`]. This is the only way application code mints one. Always
     /// succeeds -- a window with no team selected still yields a scope, just one whose
     /// `team_uid()` is `None`; see [`TeamScope`]'s contract for what that means to a getter.
-    // Only tests call this today; remove once a Group 1 migration PR has a real call site.
-    #[allow(dead_code)]
     pub(crate) fn team_context_for_operation<T: Entity>(
         &self,
         ctx: &ViewContext<T>,
@@ -463,8 +451,6 @@ impl UserWorkspaces {
     }
 
     /// Resolves `view`'s window team for one render. See [`TeamContext`].
-    // Only tests call this today; remove once a Group 1 migration PR has a real call site.
-    #[allow(dead_code)]
     pub(crate) fn team_context<'a, T: Entity>(
         &'a self,
         view: &WeakViewHandle<T>,
@@ -1974,19 +1960,107 @@ impl UserWorkspaces {
         }
     }
 
-    pub fn default_host_slug(&self) -> Option<&str> {
+    /// The current workspace's settings, but only when the user belongs to no team at all.
+    ///
+    /// `WorkspaceSettings` is not team-neutral data. Whenever the user has any team,
+    /// `GetEffectiveWorkspaceSettingsForWorkspace` resolves one arbitrarily-chosen team
+    /// server-side and falls through to a literal `workspaceTeamIDs[0]`, so reading it as a
+    /// default hands back some other team's policy. It is trustworthy only for a genuinely
+    /// teamless user, whose settings the server computes from tier defaults. This applies the
+    /// same guard as [`Self::teams_allow_codebase_context`], which is the shape scoped getters
+    /// reuse for their no-team branch.
+    fn teamless_workspace_settings(&self) -> Option<&WorkspaceSettings> {
+        let is_on_a_team = self
+            .workspaces
+            .iter()
+            .any(|workspace| !workspace.teams.is_empty());
+        if is_on_a_team {
+            return None;
+        }
         self.current_workspace()
-            .and_then(|workspace| workspace.settings.default_host_slug.as_deref())
+            .map(|workspace| &workspace.settings)
     }
 
-    /// Returns the team-level agent attribution setting.
+    /// The default self-hosted worker host slug configured for `scope`'s team.
     ///
-    /// Use this to decide whether the user's attribution toggle should be locked
-    /// (`Enable`/`Disable`) or editable (`RespectUserSetting`).
-    pub fn get_agent_attribution_setting(&self) -> AdminEnablementSetting {
+    /// Returns `None` when that team configures none, and also when the scope has no team
+    /// while the user is on some other team: another team's host is not a substitute. See
+    /// [`TeamScope`].
+    pub(crate) fn default_host_slug_for_scope(&self, scope: &impl TeamScope) -> Option<&str> {
+        match scope.team_uid() {
+            Some(team_uid) => self
+                .team_from_uid(team_uid)
+                .and_then(|team| team.settings.default_host_slug.as_deref()),
+            None => self
+                .teamless_workspace_settings()
+                .and_then(|settings| settings.default_host_slug.as_deref()),
+        }
+    }
+
+    /// Whether *some* team the user belongs to configures a default self-hosted worker host.
+    ///
+    /// This answers only the availability question a windowless surface can honestly ask: the
+    /// `/host` slash command is worth offering when a default host exists anywhere. It
+    /// deliberately does not choose *which* slug, because there is no defensible ordering over
+    /// host slugs the way [`AdminEnablementSetting`] has a most-restrictive direction — with
+    /// two teams configuring different hosts, any pick is arbitrary. Windowed callers must use
+    /// [`Self::default_host_slug_for_scope`] instead; picking a slug without a window is a
+    /// product decision that has not been made.
+    ///
+    /// Falls back to workspace settings only when the user is on no team, mirroring
+    /// [`Self::teams_allow_codebase_context`]'s empty-iterator guard.
+    pub fn any_team_has_default_host_slug(&self) -> bool {
+        let mut team_slugs = self
+            .workspaces
+            .iter()
+            .flat_map(|workspace| workspace.teams.iter())
+            .map(|team| &team.settings.default_host_slug)
+            .peekable();
+
+        if team_slugs.peek().is_none() {
+            return self
+                .teamless_workspace_settings()
+                .is_some_and(|settings| settings.default_host_slug.is_some());
+        }
+
+        team_slugs.any(Option::is_some)
+    }
+
+    /// The default self-hosted worker host slug from the current workspace's settings.
+    ///
+    /// **Not a team-neutral read**, despite reading workspace settings: see
+    /// [`Self::teamless_workspace_settings`] for why. Sole remaining caller is
+    /// `ai::orchestration::resolve_default_host_slug`, which feeds the plan card, the
+    /// confirmation card, the TUI orchestration block and the handoff pipeline. That chain
+    /// still needs both a windowless accessor the TUI can reach and a pinned scope for the
+    /// handoff's chosen destination, so it moves as one follow-up rather than piecemeal.
+    /// Do not add callers: windowed code uses [`Self::default_host_slug_for_scope`], and a
+    /// windowless availability check uses [`Self::any_team_has_default_host_slug`].
+    pub fn unscoped_default_host_slug(&self) -> Option<&str> {
         self.current_workspace()
-            .map(|workspace| workspace.settings.enable_warp_attribution.clone())
-            .unwrap_or_default()
+            .and_then(|workspace| workspace.settings.default_host_slug.as_deref())
+    }
+
+    /// The agent attribution policy for `scope`'s team: `Enable` or `Disable` lock the user's
+    /// attribution toggle, `RespectUserSetting` leaves it editable.
+    ///
+    /// This is live UI state rather than a recorded fact, so resolve it from the rendering
+    /// window's [`TeamContext`] on each frame; a value captured when a surface opened goes
+    /// stale the moment that window switches team.
+    pub(crate) fn agent_attribution_setting_for_scope(
+        &self,
+        scope: &impl TeamScope,
+    ) -> AdminEnablementSetting {
+        match scope.team_uid() {
+            Some(team_uid) => self
+                .team_from_uid(team_uid)
+                .map(|team| team.settings.enable_warp_attribution.clone())
+                .unwrap_or_default(),
+            None => self
+                .teamless_workspace_settings()
+                .map(|settings| settings.enable_warp_attribution.clone())
+                .unwrap_or_default(),
+        }
     }
 
     pub fn teams_allow_codebase_context(&self) -> AdminEnablementSetting {