fix(web): collapse the "Add profile" form on load like session/secret

[defangdevs]

Motivation

Fixes #532. settings.js's init-time editor-collapse list omitted
"profile-editor", so the "Add profile" form rendered in its
server-rendered, always-visible (no-JS-fallback) state instead of
collapsing behind the "Add profile" button the way "Add session" and
"Add secret" already do. First click on "Add profile" then actually
hid it (toggling hidden false -> true) instead of revealing it.

Fix

One-line addition to the shared collapse-on-load list in
modules/src/settings.js. The click handler and .editor/hidden
mechanism were already generic over any data-toggle id, so nothing
else needed to change.

User-visible effect

"Add profile" now matches "Add session"/"Add secret": collapsed by
default, expands on click. No security effect (client-side
progressive-enhancement only; the no-JS form POST path is unaffected).

Screenshots

Before (both forms collapsed, only the buttons show):

After clicking "Add profile" (form expands, session form stays collapsed):

Verified locally by assembling settings-daemon.py from this branch's
working tree (no Nix build needed) and driving real headless Chromium
over CDP against it — clicking both "Add profile" and "Add session" and
reading back each editor's hidden state.

Checks run

• nix build -L .#checks.aarch64-linux.module-generated-up-to-date — pass
• nix build -L .#checks.aarch64-linux.assemble-module-escaping — pass
• nix run .#update-golden — regenerated tests/golden/ for the
  settings.js payload change (checked tests/native/expected too;
  it doesn't embed this payload, nothing to regenerate there)
• /code-review (medium) — one finding (stale golden snapshot), fixed
  before this push
• The settings-page VM test is x86_64-only and this box is aarch64, so
  it could not be run natively here; live-browser verification above
  covers the same behavior. CI will run it.
• Added an e2e Playwright test
  (tests/e2e/settings-page.spec.ts) asserting all three editors
  (session/profile/secret) start hidden and open on click — none of the
  existing tests checked an editor's initial hidden state, so this bug
  had no regression coverage before.

No AWS/IAM/networking impact (settings-page JS only).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: fd208cda-051a-4f68-9a62-829129a4f339

📥 Commits

Reviewing files that changed from the base of the PR and between 598b2de and 9e9f880.

📒 Files selected for processing (4)

• modules/agent-box.nix
• modules/src/settings.js
• tests/e2e/settings-page.spec.ts
• tests/golden/web/payloads/agent-box-settings/bin/agent-box-settings

Included review availability: Your plan provides up to 8 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

The settings initialization now collapses profile-editor when JavaScript is active. The generated payload matches the source change. An end-to-end test verifies initial collapse and button-driven opening behavior.

Changes

Settings profile editor

Layer / File(s)	Summary
Collapse profile editor during initialization modules/src/settings.js, modules/agent-box.nix, tests/golden/web/payloads/agent-box-settings/bin/agent-box-settings	The JavaScript collapse lists include profile-editor in the source and generated payload.
Validate editor visibility and toggling tests/e2e/settings-page.spec.ts	The end-to-end test checks that the session, profile, and secret editors are collapsed on load and that the session and profile editors open when clicked.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9e9f8

The settings page now initially collapses the Add profile form when JavaScript is enabled, matching the other editors, while the existing button interaction reveals it. The implementation and generated output are aligned and covered by browser regression testing.

Suggested reviewers: lionello, codex

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: collapsing the "Add profile" form on page load to match the session and secret forms.
Description check	✅ Passed	The description directly explains the bug, fix, user-visible effect, test coverage, generated-file updates, and validation results. It is fully related to the changeset.
Linked Issues check	✅ Passed	The pull request adds "profile-editor" to the initialization collapse list and adds end-to-end coverage for the hidden initial state and click behavior. These changes satisfy the coding objectives in …
Out of Scope Changes check	✅ Passed	The Nix module update, golden payload update, and Playwright regression test support the settings JavaScript change and linked issue. No unrelated code changes are present.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

Full details: Linked Issues check

Explanation

The pull request adds "profile-editor" to the initialization collapse list and adds end-to-end coverage for the hidden initial state and click behavior. These changes satisfy the coding objectives in issue [#532].

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/532-profile-editor-collapse

---

_{Comment @coderabbitai help to get the list of available commands.}