refactor(tray): extract Hub and tray presentation models (#1082)

* refactor(tray): extract Hub and tray presentation models

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* fix(tray): preserve current session projection after rebase

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 529161b9-67ce-4fde-98b4-c96d8991faff

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Karen Lai <7976322+karkarl@users.noreply.github.com>
Copilot-Session: 529161b9-67ce-4fde-98b4-c96d8991faff

Author: karkarl

docs/ARCHITECTURE.md

@@ -70,6 +70,9 @@ These are the canonical homes. Do not reintroduce private copies elsewhere.
 | Managed-local automatic repair eligibility and orchestration | `ManagedLocalGatewayAutoRepairMonitor` + `ManagedLocalGatewayRepairCoordinator` | authoritative |
 | Permissions page state, settings commands, and exec-approvals presentation | `PermissionsPageViewModel` | authoritative |
 | Permissions runtime status projection | `PermissionsPageRuntimeSource` | authoritative |
+| Hub navigation tags, page mapping, command catalog/search, and gateway-page classification | `HubPageRegistry` | authoritative |
+| Hub notification banner severity and action projection | `AppNotificationInfoBarPresenter` | authoritative |
+| Tray-menu semantic composition and connection-toggle state | `TrayMenuPresenter` + `ConnectionTogglePresenter` | authoritative |
 | Capability UI metadata | `NodeCapabilityUiCatalog` (planned) | planned |
 | Capability registration/gating | `NodeCapabilityRegistrationPolicy` (planned) | planned |
 | Local MCP exposure policy | `McpCapabilityPolicy` (planned) | planned |
@@ -81,6 +84,8 @@ These are the canonical homes. Do not reintroduce private copies elsewhere.
 | If you are editing… | Do not grow it. Extract toward… |
 | --- | --- |
 | `src/OpenClaw.Tray.WinUI/App.xaml.cs` | `IWindowManager`, `ITrayController`, `IActivationRouter`, `ISettingsChangeCoordinator`, `AppBootstrapper` |
+| `src/OpenClaw.Tray.WinUI/Windows/HubWindow.xaml.cs` | navigation/catalog policy → `HubPageRegistry`; notification banner projection → `AppNotificationInfoBarPresenter`; keep Frame, NavigationView, back-stack mutation, control application, and route side effects in the view |
+| `src/OpenClaw.Tray.WinUI/Services/TrayMenuRenderer.cs` | semantic composition → `TrayMenuPresenter`; connection toggle projection → `ConnectionTogglePresenter`; keep WinUI control construction and callback application in the renderer |
 | `src/OpenClaw.Tray.WinUI/Chat/OpenClawChatDataProvider.cs` | `ChatSendQueue`, `ChatBridgeEventPump`, `ChatHistoryLoader`, `ChatSnapshotProjector`, `AttachmentMetadataStore`; pure native tool projection stays in `NativeToolProjector` |
 | `src/OpenClaw.Tray.WinUI/Chat/OpenClawChatTimeline.cs` | `ReactorChatTimeline` (production `ItemsView` / `ItemContainer`), `ChatBubbleRenderer`, `ToolCallCardRenderer`, `PermissionRequestCard`, `AttachmentBubbleRenderer` |
 | `src/OpenClaw.Tray.WinUI/Chat/OpenClawComposer.cs` | `ComposerViewModel`, `SlashCommandPalette`, `AttachmentPreviewStrip`, `VoiceComposerController` |
@@ -165,6 +170,11 @@ leading and trailing pipe. Columns, in order:
 | cmd-payload-tokenization | authoritative | src/OpenClaw.Shared/ExecApprovals/ExecReusableCommandBinder.cs | parsing a cmd payload into tokens and rewriting its executable token | CmdPayloadTokenizer | ExecReusableCommandBinder.TryTokenizeStaticCmdPayload remains as a delegating wrapper for existing callers and tests | a payload rewrite is built from parsed token spans and is accepted only after re-parsing proves the argument list is unchanged except for the pinned executable | ExecReusableCommandBinderTests.PinnedCarrier_DoesNotRewriteArgumentsThatRepeatTheExecutableText | behavioral | - |
 | exec-carrier-cwd-ambiguity-check | closed | src/OpenClaw.Shared/ExecApprovals/ExecReusableCommandBinder.cs | deciding whether a carrier payload may be durably approved when the working directory could shadow it | CanonicalCmdCarrier.TryBuildPinnedCarrier (payload executable pinning) | - | the approval-time working-directory check is deleted, not merely bypassed: ExecCommandResolver exposes no HasCurrentDirectoryCandidate, a trusted carrier's payload executable is pinned to its resolved absolute path so cmd has nothing to search for, and a post-approval shadow cannot win | ExecReusableCommandBinderTests.PinnedCarrier_IgnoresShadowInsertedAfterApproval | behavioral | - |
 | exec-legacy-host-quarantine | authoritative | src/OpenClaw.Shared/ExecApprovals/ExecCommandToken.cs | deciding whether a provenance-less path-only allowlist entry authorizes an interpreter or code host | ExecAllowlistMatcher.MatchInternal via ExecCommandToken.IsLegacyQuarantinedHost | argument binding remains the security boundary for every rule this node generates | an allowlist entry with no source and no argPattern is inert when its resolved target is a command host the previous model refused, is never deleted or migrated, and is superseded only by an explicit allow-always sibling carrying source and argPattern | ExecAllowlistArgBindingTests.LegacyPathOnlyEntryForACommandHost_IsInert | behavioral | - |
+| hub-page-registry | authoritative | src/OpenClaw.Tray.WinUI/Windows/HubWindow.xaml.cs and GatewayNavVisibilityDebouncePolicy | navigation aliases, page mapping, command metadata and search, and gateway-page classification | HubPageRegistry | HubWindow keeps Frame and NavigationView application, back-stack mutation, command cache lifetime, and semantic action execution; GatewayNavVisibilityDebouncePolicy keeps disconnect timing | every current direct, legacy, and agent-scoped tag resolves identically; command order, titles, actions, search caps, and gateway prune set remain stable | HubPageRegistryTests.BuildCommands_PreservesBaseOrderActionsIconsAndResourceKeys | behavioral | - |
+| hub-page-registry-closed | closed | src/OpenClaw.Tray.WinUI/Windows/HubWindow.xaml.cs and GatewayNavVisibilityDebouncePolicy | private tag/page switches, command catalogs or search predicates, and gateway-page tag lists | HubPageRegistry | view-only navigation application and debounce timing listed in hub-page-registry | HubWindow and the debounce policy do not regain catalog or page-classification copies | HubPresentationContractTests.HubPageRegistry_OwnsMappingsCommandsAndGatewayClassification | source-shape | when HubWindow is replaced by a different shell and GatewayNavVisibilityDebouncePolicy is retired |
+| app-notification-infobar-presentation | authoritative | src/OpenClaw.Tray.WinUI/Windows/HubWindow.xaml.cs | banner severity filtering, selected-banner fallback, notification action versus Show more, and action enabled state | AppNotificationInfoBarPresenter | HubWindow keeps notification subscription, bell reconciliation, WinUI control assignment, navigation, and dismissal side effects | Warning and Error banners retain priority and hiding semantics while action projection stays WinUI-free | AppNotificationInfoBarPresenterTests.Present_ActionableNotificationWinsOverShowMore | behavioral | - |
+| tray-menu-presentation | authoritative | TrayMenuStateBuilder and src/OpenClaw.Tray.WinUI/App.xaml.cs | tray row and flyout presence, ordering, text, formatting, icon identity, action, checked and enabled state, accelerator, accessibility names, and connection-toggle projection | TrayMenuPresenter + ConnectionTogglePresenter | App captures immutable input and owns callbacks, persistence, reconnect and live-control synchronization; TrayMenuRenderer builds WinUI controls; TrayMenuWindow owns popup mechanics | equal immutable snapshots project equal complete menus; connected and disconnected compositions, all nine permission toggles, and transient connection states preserve behavior | TrayMenuPresenterTests.Connected_ProjectsExactTopLevelAndNestedOrder | behavioral | - |
+| tray-menu-state-builder-closed | closed | TrayMenuStateBuilder and src/OpenClaw.Tray.WinUI/App.xaml.cs | snapshot interpretation, semantic menu construction, and duplicated connection-toggle decisions | TrayMenuPresenter + ConnectionTogglePresenter | mechanical rendering, immutable snapshot capture, action dispatch, persistence callbacks, weak control references, and Win32 popup behavior | presentation owners stay WinUI/App/concrete-settings free and the renderer does not interpret runtime snapshots | TrayMenuPresentationContractTests.PresentationFiles_AreWinUiAppAndConcreteSettingsFree | source-shape | when the tray menu no longer uses WinUI rendering |
 <!-- LEDGER:END -->
 
 ## Deferred test builders

src/OpenClaw.Tray.WinUI/App.xaml.cs

@@ -1286,10 +1286,9 @@ private void OnTrayMenuItemClicked(object? sender, string action)
             case "exit": ExitApplication(); break;
             case "about": ShowHub("about"); break;
             default:
-                if (action.StartsWith("perm-toggle|", StringComparison.Ordinal)
-                    && _permToggleActions.TryGetValue(action, out var permAction))
+                if (action.StartsWith("perm-toggle|", StringComparison.Ordinal))
                 {
-                    permAction();
+                    ToggleTrayPermission(action);
                 }
                 else if (action.StartsWith("session-reset|", StringComparison.Ordinal))
                     _ = ExecuteSessionActionAsync("reset", action["session-reset|".Length..]);
@@ -1581,37 +1580,116 @@ private bool TryPersistPermissionSetting(
         }
     }
 
+    private void ToggleTrayPermission(string action)
+    {
+        if (_settings is null)
+            return;
+
+        switch (action)
+        {
+            case "perm-toggle|Windows node":
+                PersistTrayPermission(
+                    nameof(SettingsManager.EnableNodeMode),
+                    !_settings.EnableNodeMode,
+                    (edit, value) => edit.EnableNodeMode = value,
+                    (settings, value) => settings.EnableNodeMode = value);
+                break;
+            case "perm-toggle|System tools":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeSystemRunEnabled),
+                    !_settings.NodeSystemRunEnabled,
+                    (edit, value) => edit.NodeSystemRunEnabled = value,
+                    (settings, value) => settings.NodeSystemRunEnabled = value);
+                break;
+            case "perm-toggle|Browser control":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeBrowserProxyEnabled),
+                    !_settings.NodeBrowserProxyEnabled,
+                    (edit, value) => edit.NodeBrowserProxyEnabled = value,
+                    (settings, value) => settings.NodeBrowserProxyEnabled = value);
+                break;
+            case "perm-toggle|Camera":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeCameraEnabled),
+                    !_settings.NodeCameraEnabled,
+                    (edit, value) => edit.NodeCameraEnabled = value,
+                    (settings, value) => settings.NodeCameraEnabled = value);
+                break;
+            case "perm-toggle|Canvas":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeCanvasEnabled),
+                    !_settings.NodeCanvasEnabled,
+                    (edit, value) => edit.NodeCanvasEnabled = value,
+                    (settings, value) => settings.NodeCanvasEnabled = value);
+                break;
+            case "perm-toggle|Screen capture":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeScreenEnabled),
+                    !_settings.NodeScreenEnabled,
+                    (edit, value) => edit.NodeScreenEnabled = value,
+                    (settings, value) => settings.NodeScreenEnabled = value);
+                break;
+            case "perm-toggle|Location":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeLocationEnabled),
+                    !_settings.NodeLocationEnabled,
+                    (edit, value) => edit.NodeLocationEnabled = value,
+                    (settings, value) => settings.NodeLocationEnabled = value);
+                break;
+            case "perm-toggle|Voice (TTS)":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeTtsEnabled),
+                    !_settings.NodeTtsEnabled,
+                    (edit, value) => edit.NodeTtsEnabled = value,
+                    (settings, value) => settings.NodeTtsEnabled = value);
+                break;
+            case "perm-toggle|Speech-to-text (STT)":
+                PersistTrayPermission(
+                    nameof(SettingsManager.NodeSttEnabled),
+                    !_settings.NodeSttEnabled,
+                    (edit, value) => edit.NodeSttEnabled = value,
+                    (settings, value) => settings.NodeSttEnabled = value);
+                break;
+        }
+    }
+
+    private void PersistTrayPermission(
+        string settingName,
+        bool value,
+        Action<ISettingsEditor, bool> edit,
+        Action<SettingsManager, bool> fallbackEdit)
+    {
+        if (TryPersistPermissionSetting(
+            ref _trayPermissionWriteOrigin,
+            $"tray permissions flyout ({settingName})",
+            settings => edit(settings, value),
+            settings => fallbackEdit(settings, value),
+            out _))
+        {
+            ReconnectWithSyncedBrowserProxyForward();
+        }
+    }
+
     private void BuildTrayMenuPopup(TrayMenuWindow menu)
     {
         // Preview data must be applied before snapshot capture so the injected
         // values are visible to the builder without coupling it to App state.
         ApplyTrayMenuPreviewDataIfRequested();
         var snapshot = CaptureTrayMenuSnapshot();
+        var presentation = new TrayMenuPresenter(snapshot).Present();
         var callbacks = new TrayMenuCallbacks(
             DispatchAction: action => OnTrayMenuItemClicked(null, action),
-            UpdatePermissionAndReconnect: (settingName, edit, fallbackEdit) =>
-            {
-                if (TryPersistPermissionSetting(
-                    ref _trayPermissionWriteOrigin,
-                    $"tray permissions flyout ({settingName})",
-                    edit,
-                    fallbackEdit,
-                    out _))
-                {
-                    ReconnectWithSyncedBrowserProxyForward();
-                }
-            },
             TrackConnectionToggle: toggle => _connectionToggleRef = new WeakReference<ToggleSwitch>(toggle),
             IsConnectionToggleSuspended: () => _suspendConnectionToggleEvent);
-        var builder = new TrayMenuStateBuilder(snapshot, _permToggleActions, callbacks);
+        var renderer = new TrayMenuRenderer(presentation, callbacks);
 
         // Render the whole menu inside a single update batch so layout
         // measures only once instead of once-per-row. Pair with EndUpdate
         // in finally so an exception mid-build doesn't wedge layout.
         menu.BeginUpdate();
         try
         {
-            builder.Build(menu);
+            renderer.Render(menu);
         }
         finally
         {
@@ -1651,20 +1729,44 @@ private TrayMenuSnapshot CaptureTrayMenuSnapshot()
             OverallState = _connectionManager?.CurrentSnapshot.OverallState,
             AuthFailureMessage = _appState?.AuthFailureMessage,
             GatewayUrl = _gatewayRegistry?.GetActive()?.Url ?? _settings?.GetEffectiveGatewayUrl(),
-            GatewaySelf = _appState?.GatewaySelf,
-            Presence = _appState?.Presence,
+            GatewaySelf = TrayGatewaySelfSnapshot.From(_appState?.GatewaySelf),
+            Presence =
+            [
+                .. (_appState?.Presence ?? Array.Empty<PresenceEntry>())
+                    .Select(TrayPresenceSnapshot.From),
+            ],
             EnableNodeMode = _settings?.EnableNodeMode == true && _nodeService != null,
             NodeIsPaired = _nodeService?.IsPaired ?? false,
             NodeIsPendingApproval = _nodeService?.IsPendingApproval ?? false,
             NodeIsConnected = _nodeService?.IsConnected ?? false,
-            NodePairList = _appState?.NodePairList,
-            DevicePairList = _appState?.DevicePairList,
-            Nodes = _appState?.Nodes ?? Array.Empty<GatewayNodeInfo>(),
-            Sessions = _appState?.Sessions ?? Array.Empty<SessionInfo>(),
-            Usage = _appState?.Usage,
-            UsageStatus = _appState?.UsageStatus,
-            UsageCost = _appState?.UsageCost,
-            Settings = _settings,
+            NodePendingPairCount = _appState?.NodePairList?.Pending.Count ?? 0,
+            DevicePendingPairCount = _appState?.DevicePairList?.Pending.Count ?? 0,
+            Nodes =
+            [
+                .. (_appState?.Nodes ?? Array.Empty<GatewayNodeInfo>())
+                    .Select(TrayNodeSnapshot.From),
+            ],
+            Sessions =
+            [
+                .. (_appState?.Sessions ?? Array.Empty<SessionInfo>())
+                    .Select(TraySessionSnapshot.From),
+            ],
+            Usage = TrayUsageSnapshot.From(_appState?.Usage),
+            UsageStatus = TrayUsageStatusSnapshot.From(_appState?.UsageStatus),
+            UsageCost = TrayUsageCostSnapshot.From(_appState?.UsageCost),
+            Settings = _settings is null
+                ? null
+                : new TrayMenuSettingsSnapshot(
+                    _settings.EnableNodeMode,
+                    _settings.EnableMcpServer,
+                    _settings.NodeSystemRunEnabled,
+                    _settings.NodeBrowserProxyEnabled,
+                    _settings.NodeCameraEnabled,
+                    _settings.NodeCanvasEnabled,
+                    _settings.NodeScreenEnabled,
+                    _settings.NodeLocationEnabled,
+                    _settings.NodeTtsEnabled,
+                    _settings.NodeSttEnabled),
             SetupMenuLabel = setupMenuLabel,
             ShowSetupMenuEntry = !hasSetupManagedLocalWslGateway,
             LastUpdated = _appState?.LastCheckTime,
@@ -1764,8 +1866,6 @@ private void ApplyTrayMenuPreviewDataIfRequested()
     }
 
 
-    private readonly Dictionary<string, Action> _permToggleActions = new(StringComparer.Ordinal);
-
     #region Gateway Client
 
     private void InitializeGatewayClient(bool useBootstrapHandoffAuth = false)
@@ -3318,22 +3418,12 @@ private void SyncConnectionToggle(ConnectionStatus status, OverallConnectionStat
             return;
         }
 
-        var shouldBeOn = ConnectionStatusPresenter.IsLiveOrPending(overallState, status);
-        var canToggle = overallState switch
-        {
-            OverallConnectionState.Connecting or OverallConnectionState.Disconnecting => false,
-            null => status is ConnectionStatus.Connected or ConnectionStatus.Disconnected or ConnectionStatus.Error,
-            _ => true
-        };
-        var statusText = ConnectionStatusPresenter.PlainText(overallState, status);
+        var presentation = ConnectionTogglePresenter.Present(status, overallState);
         _suspendConnectionToggleEvent = true;
         try
         {
-            TrayMenuWindow.SetMenuToggleSwitchState(toggle, shouldBeOn, canToggle);
-            ToolTipService.SetToolTip(toggle,
-                shouldBeOn ? $"{statusText} - toggle off to disconnect"
-                    : status == ConnectionStatus.Connecting ? "Connecting..."
-                    : $"{statusText} - toggle on to connect");
+            TrayMenuWindow.SetMenuToggleSwitchState(toggle, presentation.IsOn, presentation.IsEnabled);
+            ToolTipService.SetToolTip(toggle, presentation.ToolTip);
         }
         finally
         {