@cat-factory/app 0.217.2 → 0.219.0

package/app/components/panels/inspector/TaskExecution.vue

@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import { isDryRun } from '@cat-factory/contracts'
 import type { Block } from '~/types/domain'
 import { agentKindMeta } from '~/utils/catalog'
 import {
@@ -48,6 +49,12 @@ const reviewStageLabel = computed(() =>
 
 const instance = computed(() => execution.getInstance(props.block.executionId))
 
+// Whether this run may land its work at all. Read through the contracts helper rather than an
+// equality here, so a run persisted before the mode existed (absent ⇒ live) is never badged as a
+// sandbox. Both routes into the mode look identical from here on purpose: what the reader needs
+// is that nothing will merge, and WHY is answered by the run's own notes and the merge decision.
+const sandboxed = computed(() => isDryRun(instance.value?.mode))
+
 // Nothing to show yet: no run, no failed run, no PR, and not awaiting a merge — render an
 // empty state instead of a blank gap so the section reads as "no runs yet" rather than broken.
 const isEmpty = computed(
@@ -266,8 +273,23 @@ async function mergePr() {
     <!-- running pipeline -->
     <div v-if="instance">
       <div class="mb-1 flex items-center justify-between">
-        <span class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
-          {{ instance.pipelineName }}
+        <span class="flex min-w-0 items-center gap-1.5">
+          <span class="truncate text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+            {{ instance.pipelineName }}
+          </span>
+          <!-- A sandboxed run looks exactly like one that simply has not reached the merge yet,
+               right up until it stops there, so it says what it is from the start. -->
+          <UBadge
+            v-if="sandboxed"
+            color="warning"
+            variant="subtle"
+            size="sm"
+            icon="i-lucide-shield"
+            :title="t('inspector.execution.dryRunHint')"
+            data-testid="run-dry-run"
+          >
+            {{ t('inspector.execution.dryRun') }}
+          </UBadge>
         </span>
         <div class="flex items-center gap-1">
           <!-- Stop without deleting: halts the run but keeps it readable + retryable. -->

package/app/components/riskPolicy/RiskPolicyPreview.vue

@@ -8,12 +8,29 @@
 // A policy with auto-merge off has no thresholds to explain (the master switch wins before
 // any score is compared), so it says so instead of listing ceilings that never apply.
 import { computed } from 'vue'
-import type { RiskPolicy } from '~/types/merge'
-import { riskPolicyCeilings, type RiskPolicyAxis } from '~/utils/riskPolicy'
+import type { RiskPolicy, WorkspaceRole } from '~/types/merge'
+import { riskPolicyCeilings, rolePolicySummary, type RiskPolicyAxis } from '~/utils/riskPolicy'
 
 const props = defineProps<{ policy: RiskPolicy }>()
 const { t, n } = useI18n()
 
+// The role layer, when the policy has one. Worth a line here rather than only in settings: this
+// preview is what a task's merge-policy picker shows, and "runs started by a member never merge"
+// changes what picking this policy means for whoever is reading it.
+const ROLE_LABEL: Record<WorkspaceRole, () => string> = {
+  admin: () => t('merge.role.admin'),
+  member: () => t('merge.role.member'),
+  viewer: () => t('merge.role.viewer'),
+}
+const roleLayer = computed(() => {
+  const { sandboxed, narrowed } = rolePolicySummary(props.policy)
+  return {
+    sandboxed: sandboxed.map((r) => ROLE_LABEL[r]()).join(', '),
+    narrowed: narrowed.map((r) => ROLE_LABEL[r]()).join(', '),
+    any: sandboxed.length > 0 || narrowed.length > 0,
+  }
+})
+
 // Exhaustive over the axis union with LITERAL keys, so both i18n drift guards apply: the
 // typed-key check catches a renamed key, and the Record catches a new axis.
 const AXIS_LABEL: Record<RiskPolicyAxis, () => string> = {
@@ -68,6 +85,20 @@ const ceilings = computed(() =>
       </p>
     </div>
 
+    <!-- Who started the run changes what may land, on a policy that says so. -->
+    <div v-if="roleLayer.any" data-testid="risk-policy-preview-roles">
+      <div class="mb-1 flex items-center gap-1 text-[10px] uppercase tracking-wide text-slate-500">
+        <UIcon name="i-lucide-users" class="h-3 w-3" />
+        {{ t('riskPolicy.preview.roleHeading') }}
+      </div>
+      <p v-if="roleLayer.sandboxed" class="text-[12px] leading-snug text-slate-400">
+        {{ t('riskPolicy.preview.roleSandboxed', { roles: roleLayer.sandboxed }) }}
+      </p>
+      <p v-if="roleLayer.narrowed" class="text-[12px] leading-snug text-slate-400">
+        {{ t('riskPolicy.preview.roleNarrowed', { roles: roleLayer.narrowed }) }}
+      </p>
+    </div>
+
     <div>
       <div class="mb-1 flex items-center gap-1 text-[10px] uppercase tracking-wide text-slate-500">
         <UIcon name="i-lucide-wrench" class="h-3 w-3" />

package/app/components/settings/MergeRolePolicyEditor.logic.spec.ts

@@ -0,0 +1,146 @@
+import { describe, expect, it } from 'vitest'
+import { MERGE_CLASS_RULES } from '@cat-factory/contracts'
+import type { ClassRulesByRole, MergeClassRules } from '~/types/merge'
+import {
+  INHERIT_RULE,
+  narrowingOptionsFor,
+  roleClassRuleRows,
+  roleNarrowedCount,
+  setRoleClassRule,
+  toggleDryRunRole,
+} from '~/components/settings/MergeRolePolicyEditor.logic'
+
+describe('narrowingOptionsFor', () => {
+  it('offers only the rules that would actually narrow the base', () => {
+    expect(narrowingOptionsFor('always')).toEqual(['thresholds', 'never'])
+    expect(narrowingOptionsFor('thresholds')).toEqual(['never'])
+  })
+
+  // Nothing is stricter than "always require review", so the editor has nothing to offer a role
+  // on that class rather than an option that silently does nothing.
+  it('offers nothing on a class the policy already routes to a human', () => {
+    expect(narrowingOptionsFor('never')).toEqual([])
+  })
+})
+
+// The sentinel is a VALUE the select renders as an item, and Reka UI's `SelectItem` throws on an
+// empty-string value (it reserves `''` for "cleared, show the placeholder"). Nothing here can see
+// that widget, so the invariant it imposes is asserted where it is authored: the failure it
+// prevents is not a wrong label, it is the settings panel throwing when a role group is expanded.
+describe('INHERIT_RULE', () => {
+  it('is a non-empty value the select can carry as an item', () => {
+    expect(INHERIT_RULE).not.toBe('')
+    expect(INHERIT_RULE.length).toBeGreaterThan(0)
+  })
+
+  // It is also not one of the rules, or clearing a row would be indistinguishable from setting it.
+  it('cannot collide with a real rule', () => {
+    expect(MERGE_CLASS_RULES).not.toContain(INHERIT_RULE as string)
+  })
+})
+
+describe('roleClassRuleRows', () => {
+  const base: MergeClassRules = { docs: 'always', schema: 'never' }
+
+  // The sentinel is truthy, so anything asking "did this role author a rule" by testing the
+  // SELECTION rather than the stored entry reads inheritance as a stored rule: it would offer
+  // "same as this policy" twice on every untouched row, and flag every one of them redundant.
+  it('never treats inheritance as a stored rule', () => {
+    for (const row of roleClassRuleRows(base, undefined)) {
+      expect(row.options).not.toContain(INHERIT_RULE as string)
+      expect(row.redundant).toBe(false)
+    }
+  })
+
+  it('reads an absent entry as inheritance, never as thresholds', () => {
+    const rows = roleClassRuleRows(base, undefined)
+    expect(rows.map((r) => r.selected)).toEqual([
+      INHERIT_RULE,
+      INHERIT_RULE,
+      INHERIT_RULE,
+      INHERIT_RULE,
+      INHERIT_RULE,
+      INHERIT_RULE,
+    ])
+    expect(rows.find((r) => r.changeClass === 'docs')?.base).toBe('always')
+    expect(rows.find((r) => r.changeClass === 'source')?.base).toBe('thresholds')
+  })
+
+  it('surfaces the role rule and marks it as governing when it narrows', () => {
+    const rows = roleClassRuleRows(base, { docs: 'never' })
+    const docs = rows.find((r) => r.changeClass === 'docs')
+    expect(docs?.selected).toBe('never')
+    expect(docs?.redundant).toBe(false)
+  })
+
+  // A base edit can turn a stored role rule into a no-op. The row keeps it (so it can be read and
+  // cleared) and says it no longer does anything, rather than dropping it and reading as clean.
+  it('keeps a rule the base rule has overtaken, flagged as having no effect', () => {
+    const rows = roleClassRuleRows({ docs: 'never' }, { docs: 'thresholds' })
+    const docs = rows.find((r) => r.changeClass === 'docs')
+    expect(docs?.selected).toBe('thresholds')
+    expect(docs?.redundant).toBe(true)
+    expect(docs?.options).toContain('thresholds')
+  })
+})
+
+describe('setRoleClassRule', () => {
+  it('writes a rule under the role', () => {
+    expect(setRoleClassRule({}, 'member', 'source', 'never')).toEqual({
+      member: { source: 'never' },
+    })
+  })
+
+  it('clears back to an omission, so absent stays absent', () => {
+    const before: ClassRulesByRole = { member: { source: 'never', docs: 'never' } }
+    expect(setRoleClassRule(before, 'member', 'docs', INHERIT_RULE)).toEqual({
+      member: { source: 'never' },
+    })
+  })
+
+  // `{}` is the identity for the whole feature, so emptying a role's last rule must reach it:
+  // a `{ member: {} }` left behind would read as a role that had been given a policy.
+  it('drops the role entirely once its last rule is cleared', () => {
+    const before: ClassRulesByRole = { admin: { docs: 'never' }, member: { source: 'never' } }
+    expect(setRoleClassRule(before, 'member', 'source', INHERIT_RULE)).toEqual({
+      admin: { docs: 'never' },
+    })
+  })
+
+  it('leaves the other roles untouched', () => {
+    const before: ClassRulesByRole = { admin: { docs: 'never' } }
+    expect(setRoleClassRule(before, 'member', 'source', 'thresholds')).toEqual({
+      admin: { docs: 'never' },
+      member: { source: 'thresholds' },
+    })
+  })
+})
+
+describe('toggleDryRunRole', () => {
+  it('adds and removes a role', () => {
+    expect(toggleDryRunRole([], 'member', true)).toEqual(['member'])
+    expect(toggleDryRunRole(['member'], 'member', false)).toEqual([])
+  })
+
+  it('keeps the shared role order whatever order the toggles arrived in', () => {
+    expect(toggleDryRunRole(['viewer'], 'admin', true)).toEqual(['admin', 'viewer'])
+    expect(toggleDryRunRole(['viewer', 'admin'], 'member', true)).toEqual([
+      'admin',
+      'member',
+      'viewer',
+    ])
+  })
+
+  it('is idempotent on a role already in the state asked for', () => {
+    expect(toggleDryRunRole(['member'], 'member', true)).toEqual(['member'])
+    expect(toggleDryRunRole([], 'member', false)).toEqual([])
+  })
+})
+
+describe('roleNarrowedCount', () => {
+  it('counts the classes a role authored, and reads absence as zero', () => {
+    expect(roleNarrowedCount(undefined)).toBe(0)
+    expect(roleNarrowedCount({})).toBe(0)
+    expect(roleNarrowedCount({ docs: 'never', source: 'never' })).toBe(2)
+  })
+})

package/app/components/settings/MergeRolePolicyEditor.logic.ts

@@ -0,0 +1,133 @@
+// Pure state math behind <MergeRolePolicyEditor>: what a preset's ROLE layer currently says, and
+// what each edit turns it into.
+//
+// It lives outside the SFC because the interesting parts are not the happy path. Two of them:
+//
+//  - **Absent is not a rule.** A role that authored nothing on a class is governed by the base
+//    rule, and that silence must survive a round trip through this editor: an edit clears back to
+//    an OMISSION rather than writing `thresholds`, and a role left with nothing drops out of the
+//    map entirely, so `{}` stays the identity the wire contract says it is.
+//  - **Narrow-only.** `narrowMergeClassRule` (contracts, the same implementation the engine
+//    applies) takes the stricter of the base and the role rule, so a role rule that is looser than
+//    the base does nothing at all. Offering one would tell an operator they had written a policy
+//    when they had written a no-op, so the options a row offers are exactly the rules that would
+//    change its outcome, plus whatever is already stored.
+import {
+  MERGE_CLASS_RULES,
+  narrowMergeClassRule,
+  RULEABLE_CHANGE_CLASSES,
+  WORKSPACE_ROLES,
+} from '@cat-factory/contracts'
+import type {
+  ClassRulesByRole,
+  MergeClassRule,
+  MergeClassRules,
+  RuleableChangeClass,
+  WorkspaceRole,
+} from '~/types/merge'
+
+/**
+ * The "this role adds nothing here" selection, stored as an OMISSION.
+ *
+ * It must be a non-empty string, and not because of a style preference: the select this feeds is
+ * Nuxt UI's `USelect` over Reka UI, whose `SelectItem` THROWS on an empty-string value (the empty
+ * string is how that widget spells "cleared, show the placeholder", so an item may not claim it).
+ * A `''` sentinel therefore does not degrade, it takes down the settings panel the moment a role
+ * group is expanded. It is a member of the selection union rather than `undefined` for the same
+ * reason: the row has to be able to OFFER inheriting as a choice, which is a value.
+ */
+export const INHERIT_RULE = 'inherit' as const
+export type RoleRuleSelection = MergeClassRule | typeof INHERIT_RULE
+
+/** One class's row inside one role's group. */
+export interface RoleClassRuleRow {
+  changeClass: RuleableChangeClass
+  /** What the preset's base `classRules` say for this class (what the row inherits). */
+  base: MergeClassRule
+  /** The role's own entry, or {@link INHERIT_RULE} when it authored none. */
+  selected: RoleRuleSelection
+  /**
+   * The rules this row may be set to: the ones strictly stricter than `base` (a looser one is
+   * discarded by the engine), plus the stored value whatever it is, so a rule that a later base
+   * edit turned into a no-op stays visible and clearable instead of vanishing from its own row.
+   */
+  options: MergeClassRule[]
+  /**
+   * The stored rule no longer changes anything, because the base rule is already at least as
+   * strict. Not an error and not silently dropped: the operator wrote it down, and the honest
+   * report is that the base map now covers it.
+   */
+  redundant: boolean
+}
+
+/**
+ * The rules that would actually narrow `base`. Empty for `never`, which is already the strictest
+ * rule there is, so a class the preset always routes to a human offers a role nothing to add.
+ */
+export function narrowingOptionsFor(base: MergeClassRule): MergeClassRule[] {
+  return MERGE_CLASS_RULES.filter((rule) => narrowMergeClassRule(base, rule) !== base)
+}
+
+/** One role's rows, in the shared class order, against the preset's base rules. */
+export function roleClassRuleRows(
+  base: MergeClassRules,
+  entry: MergeClassRules | undefined,
+): RoleClassRuleRow[] {
+  return RULEABLE_CHANGE_CLASSES.map((changeClass) => {
+    const baseRule = base[changeClass] ?? 'thresholds'
+    // The role's own rule, or nothing at all. Held as `undefined` rather than folded into
+    // `selected` up front because "did this role author a rule here" is the question the two
+    // lines below both ask, and an absent entry is the one answer that is not one of the three
+    // rules. Testing the SENTINEL for that would tie them to whatever string it happens to be.
+    const stored = entry?.[changeClass]
+    const narrowing = narrowingOptionsFor(baseRule)
+    return {
+      changeClass,
+      base: baseRule,
+      selected: stored ?? INHERIT_RULE,
+      options: stored && !narrowing.includes(stored) ? [...narrowing, stored] : narrowing,
+      redundant: !!stored && narrowMergeClassRule(baseRule, stored) === baseRule,
+    }
+  })
+}
+
+/**
+ * Set (or clear) one role's rule for one class, pruning back to the identity: clearing the last
+ * rule a role carried removes the role's entry, so a preset an operator has emptied is byte-for-byte
+ * the `{}` a preset that never had a role rule carries.
+ */
+export function setRoleClassRule(
+  byRole: ClassRulesByRole,
+  role: WorkspaceRole,
+  changeClass: RuleableChangeClass,
+  rule: RoleRuleSelection,
+): ClassRulesByRole {
+  const entry: MergeClassRules = { ...byRole[role] }
+  if (rule === INHERIT_RULE) delete entry[changeClass]
+  else entry[changeClass] = rule
+  const next: ClassRulesByRole = { ...byRole }
+  if (Object.keys(entry).length === 0) delete next[role]
+  else next[role] = entry
+  return next
+}
+
+/**
+ * Add or remove a role from the sandboxed list, keeping it in the shared role order so two presets
+ * carrying the same policy carry the same array (and a diff of a preset reads as an edit rather
+ * than a reshuffle).
+ */
+export function toggleDryRunRole(
+  roles: readonly WorkspaceRole[],
+  role: WorkspaceRole,
+  sandboxed: boolean,
+): WorkspaceRole[] {
+  const next = new Set(roles)
+  if (sandboxed) next.add(role)
+  else next.delete(role)
+  return WORKSPACE_ROLES.filter((r) => next.has(r))
+}
+
+/** How many classes a role has authored a rule for (the collapsed group's summary). */
+export function roleNarrowedCount(entry: MergeClassRules | undefined): number {
+  return entry ? Object.keys(entry).length : 0
+}

package/app/components/settings/MergeRolePolicyEditor.vue

@@ -0,0 +1,226 @@
+<script setup lang="ts">
+// The ROLE layer of one merge preset: what happens to a run depending on WHO started it.
+//
+// Two settings, edited together because they answer the same question at two strengths. A role can
+// be held to stricter per-class rules than the preset's base map (`classRulesByRole`), or held to
+// dry runs entirely (`dryRunRoles`): the pipeline works and opens its pull request, and nothing
+// merges. The second outranks the first, which is why a sandboxed role says so on its row rather
+// than leaving the class rules below reading as the policy.
+//
+// Composition is NARROW-ONLY, so this editor only offers a role rules STRICTER than the base one
+// (see MergeRolePolicyEditor.logic.ts). A looser rule is discarded by the engine, and an editor
+// that offered it would be reporting a policy that does nothing.
+import { computed, ref } from 'vue'
+import { RULEABLE_CHANGE_CLASSES, WORKSPACE_ROLES } from '@cat-factory/contracts'
+import type {
+  ClassRulesByRole,
+  DryRunRoles,
+  MergeClassRule,
+  MergeClassRules,
+  RuleableChangeClass,
+  WorkspaceRole,
+} from '~/types/merge'
+import {
+  INHERIT_RULE,
+  roleClassRuleRows,
+  roleNarrowedCount,
+  setRoleClassRule,
+  toggleDryRunRole,
+  type RoleRuleSelection,
+} from '~/components/settings/MergeRolePolicyEditor.logic'
+
+const props = defineProps<{
+  /** The preset's per-role narrowing map; a role with no entry is exactly the base rules. */
+  classRulesByRole: ClassRulesByRole
+  /** The roles whose runs this preset sandboxes. */
+  dryRunRoles: DryRunRoles
+  /** The base rules the role layer narrows, so each row can show what it inherits. */
+  classRules: MergeClassRules
+  /**
+   * Whether the preset auto-merges at all. With the master switch off, every pull request already
+   * waits for a human, so a role's per-class narrowing has nothing left to subtract. The SANDBOX
+   * still does: it refuses the MANUAL merge too, which is the one thing the master switch leaves
+   * open. The two halves of this editor therefore stop being equally meaningful, and saying so is
+   * what keeps the inert half from reading as a policy that is doing something.
+   */
+  autoMergeEnabled: boolean
+  disabled?: boolean
+}>()
+
+const emit = defineEmits<{
+  'update:classRulesByRole': [ClassRulesByRole]
+  'update:dryRunRoles': [DryRunRoles]
+}>()
+
+const { t } = useI18n()
+
+// Role + class + rule labels. Exhaustive Records keyed off the contract unions (a new member fails
+// the typecheck) holding LITERAL catalog keys so the typed-message-key check sees them. The role
+// names are the roster's, so the two surfaces name a tier identically.
+const ROLE_LABEL_KEYS: Record<WorkspaceRole, string> = {
+  admin: 'layout.workspaceMembers.roles.admin',
+  member: 'layout.workspaceMembers.roles.member',
+  viewer: 'layout.workspaceMembers.roles.viewer',
+}
+const CLASS_LABEL_KEYS: Record<RuleableChangeClass, string> = {
+  docs: 'merge.changeClass.docs',
+  test: 'merge.changeClass.test',
+  dependency: 'merge.changeClass.dependency',
+  config: 'merge.changeClass.config',
+  source: 'merge.changeClass.source',
+  schema: 'merge.changeClass.schema',
+}
+const RULE_LABEL_KEYS: Record<MergeClassRule, string> = {
+  thresholds: 'settings.riskPolicy.classRules.rule.thresholds',
+  always: 'settings.riskPolicy.classRules.rule.always',
+  never: 'settings.riskPolicy.classRules.rule.never',
+}
+
+/** Which role groups are expanded. Collapsed by default: most presets narrow nothing. */
+const expanded = ref<Partial<Record<WorkspaceRole, boolean>>>({})
+function toggleExpanded(role: WorkspaceRole) {
+  expanded.value = { ...expanded.value, [role]: !expanded.value[role] }
+}
+
+const roles = computed(() =>
+  WORKSPACE_ROLES.map((role) => {
+    const entry: MergeClassRules | undefined = props.classRulesByRole[role]
+    const narrowed = roleNarrowedCount(entry)
+    return {
+      role,
+      label: t(ROLE_LABEL_KEYS[role]),
+      sandboxed: props.dryRunRoles.includes(role),
+      narrowed,
+      open: !!expanded.value[role],
+      rows: roleClassRuleRows(props.classRules, entry).map((row) => ({
+        ...row,
+        label: t(CLASS_LABEL_KEYS[row.changeClass]),
+        // The stored rule first (it may be one a later base edit made redundant), then whatever
+        // still narrows. "Same as policy" is the absent state and always leads.
+        items: [
+          { value: INHERIT_RULE, label: t('settings.riskPolicy.roleRules.inherit') },
+          ...row.options.map((rule) => ({ value: rule, label: t(RULE_LABEL_KEYS[rule]) })),
+        ],
+      })),
+    }
+  }),
+)
+
+/** How many classes carry a base rule stricter than nothing, for the "narrows nothing" hint. */
+const anyBaseRule = computed(() =>
+  RULEABLE_CHANGE_CLASSES.some((changeClass) => !!props.classRules[changeClass]),
+)
+
+function setSandboxed(role: WorkspaceRole, sandboxed: boolean) {
+  emit('update:dryRunRoles', toggleDryRunRole(props.dryRunRoles, role, sandboxed))
+}
+
+function setRule(role: WorkspaceRole, changeClass: RuleableChangeClass, rule: RoleRuleSelection) {
+  emit('update:classRulesByRole', setRoleClassRule(props.classRulesByRole, role, changeClass, rule))
+}
+</script>
+
+<template>
+  <div data-testid="merge-role-policy" class="space-y-2">
+    <div>
+      <span class="block text-[10px] uppercase tracking-wide text-slate-500">
+        {{ t('settings.riskPolicy.roleRules.heading') }}
+      </span>
+      <p class="mt-0.5 text-[11px] leading-snug text-slate-500">
+        {{ t('settings.riskPolicy.roleRules.help') }}
+      </p>
+      <!-- Auto-merge off already sends every pull request to a human, so only the sandbox half of
+           this editor still changes anything (it refuses the manual merge as well). -->
+      <p
+        v-if="!autoMergeEnabled"
+        class="mt-1 text-[11px] leading-snug text-amber-400/90"
+        data-testid="merge-role-auto-merge-off"
+      >
+        {{ t('settings.riskPolicy.roleRules.autoMergeOffWarning') }}
+      </p>
+    </div>
+
+    <div
+      v-for="group in roles"
+      :key="group.role"
+      class="rounded-md border border-slate-700/50 bg-slate-900/30 px-2 py-1.5"
+      :data-testid="`merge-role-group-${group.role}`"
+    >
+      <div class="flex flex-wrap items-center gap-2">
+        <span class="min-w-[5rem] text-xs text-slate-300">{{ group.label }}</span>
+        <USwitch
+          :model-value="group.sandboxed"
+          size="sm"
+          :disabled="disabled"
+          :label="t('settings.riskPolicy.roleRules.sandboxLabel')"
+          :data-testid="`merge-role-sandbox-${group.role}`"
+          @update:model-value="setSandboxed(group.role, $event)"
+        />
+        <UButton
+          color="neutral"
+          variant="ghost"
+          size="xs"
+          :icon="group.open ? 'i-lucide-chevron-down' : 'i-lucide-chevron-right'"
+          :data-testid="`merge-role-expand-${group.role}`"
+          @click="toggleExpanded(group.role)"
+        >
+          {{
+            group.narrowed === 0
+              ? t('settings.riskPolicy.roleRules.noRules')
+              : t(
+                  'settings.riskPolicy.roleRules.ruleCount',
+                  { count: group.narrowed },
+                  group.narrowed,
+                )
+          }}
+        </UButton>
+      </div>
+
+      <!-- A sandboxed role merges nothing at all, so the class rules below cannot make its runs
+           any stricter. They stay editable (removing the sandbox brings them straight back) and
+           the row says which of the two is actually governing. -->
+      <p
+        v-if="group.sandboxed"
+        class="mt-1 text-[11px] leading-snug text-amber-400/90"
+        :data-testid="`merge-role-sandbox-note-${group.role}`"
+      >
+        {{ t('settings.riskPolicy.roleRules.sandboxNote') }}
+      </p>
+
+      <div v-if="group.open" class="mt-2 space-y-1.5 border-t border-slate-800 pt-2">
+        <p v-if="!anyBaseRule" class="text-[11px] leading-snug text-slate-500">
+          {{ t('settings.riskPolicy.roleRules.baseHint') }}
+        </p>
+        <div
+          v-for="row in group.rows"
+          :key="row.changeClass"
+          class="flex flex-wrap items-center gap-2"
+          :data-testid="`merge-role-row-${group.role}-${row.changeClass}`"
+        >
+          <span class="min-w-[7rem] text-xs text-slate-400">{{ row.label }}</span>
+          <USelect
+            :model-value="row.selected"
+            :items="row.items"
+            value-key="value"
+            size="sm"
+            class="w-52"
+            :disabled="disabled || row.items.length === 1"
+            :data-testid="`merge-role-rule-${group.role}-${row.changeClass}`"
+            @update:model-value="setRule(group.role, row.changeClass, $event as RoleRuleSelection)"
+          />
+          <!-- Nothing left to narrow: the base rule already routes this class to a human. -->
+          <span v-if="row.items.length === 1" class="text-[11px] text-slate-500">
+            {{ t('settings.riskPolicy.roleRules.alreadyStrictest') }}
+          </span>
+          <span
+            v-else-if="row.redundant"
+            class="text-[11px] text-amber-400/90"
+            :data-testid="`merge-role-redundant-${group.role}-${row.changeClass}`"
+          >
+            {{ t('settings.riskPolicy.roleRules.redundant') }}
+          </span>
+        </div>
+      </div>
+    </div>
+  </div>
+</template>