@cat-factory/app 0.239.0 → 0.241.0

package/app/stores/accounts.ts

@@ -1,6 +1,7 @@
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
 import { useUpsertList } from '~/composables/useUpsertList'
+import type { AuditEventWire } from '@cat-factory/contracts'
 import type {
   Account,
   AccountInvitation,
@@ -113,6 +114,73 @@ export const useAccountsStore = defineStore(
       return updated
     }
 
+    // ---- audit log + session revocation -----------------------------------
+    // The audit log is a paginated, append-only feed, so it is kept OUT of `useUpsertList`: the
+    // rows never change and never arrive out of band, and a keyed upsert list would quietly
+    // reorder a page whose whole meaning is its order. Pages are appended in the order the server
+    // served them, and `auditCursor` is opaque — it round-trips verbatim, never inspected.
+    const auditEvents = ref<AuditEventWire[]>([])
+    const auditCursor = ref<string | null>(null)
+    const auditLoading = ref(false)
+
+    /**
+     * The audit feed has fallen behind something this session did. Set by the writers below and
+     * cleared by whoever reloads; the audit viewer watches it.
+     *
+     * A flag rather than a reload, because reloading here is what conflated two outcomes: the
+     * revocation and the feed refresh are separate calls that fail separately, and awaiting the
+     * second inside the first reported a revocation that HAD succeeded as "could not sign the
+     * member out" whenever the read failed after it. It also fired on surfaces with no audit
+     * panel rendered (basic mode, and any account whose deployment wires no audit store), paying
+     * for a read nothing was going to show and turning its 503 into an error about the write.
+     *
+     * The viewer owns the reload instead, which is where it belongs: it already distinguishes a
+     * failed page from an empty one, and a refresh failure now renders in that slot rather than
+     * as a false report about the revocation.
+     */
+    const auditStale = ref(false)
+
+    /**
+     * Load the newest page, replacing whatever was held. Used on open and on refresh, so a reader
+     * is never shown a feed spliced from two different moments.
+     */
+    async function loadAuditEvents(accountId: string) {
+      auditLoading.value = true
+      // Cleared on ATTEMPT, not on success. A failed reload is reported by the viewer's own error
+      // slot, and leaving the flag set would re-trigger the watch that just failed.
+      auditStale.value = false
+      try {
+        const page = await api.listAuditEvents(accountId)
+        auditEvents.value = page.events
+        auditCursor.value = page.nextCursor
+      } finally {
+        auditLoading.value = false
+      }
+    }
+
+    /** Append the next (older) page. A no-op at the end of the log. */
+    async function loadMoreAuditEvents(accountId: string) {
+      if (!auditCursor.value || auditLoading.value) return
+      auditLoading.value = true
+      try {
+        const page = await api.listAuditEvents(accountId, { cursor: auditCursor.value })
+        auditEvents.value = [...auditEvents.value, ...page.events]
+        auditCursor.value = page.nextCursor
+      } finally {
+        auditLoading.value = false
+      }
+    }
+
+    /**
+     * End every session a member holds. Their membership and roles are untouched, so the roster
+     * needs no patching — what changed is not visible in it, which is why the audit feed is
+     * marked stale instead: the revocation's only lasting trace is the row it wrote.
+     */
+    async function revokeMemberSessions(accountId: string, userId: string) {
+      await api.revokeMemberSessions(accountId, userId)
+      auditStale.value = true
+    }
+
     // ---- email sender connection -----------------------------------------
 
     const emailConnection = ref<EmailConnection | null>(null)
@@ -144,6 +212,10 @@ export const useAccountsStore = defineStore(
       ready,
       members,
       invitations,
+      auditEvents,
+      auditCursor,
+      auditLoading,
+      auditStale,
       emailConnection,
       emailConfigured,
       load,
@@ -155,6 +227,9 @@ export const useAccountsStore = defineStore(
       invite,
       revokeInvite,
       setMemberRoles,
+      loadAuditEvents,
+      loadMoreAuditEvents,
+      revokeMemberSessions,
       loadEmailConnection,
       connectEmail,
       disconnectEmail,

package/app/stores/board/moveRefusal.spec.ts

@@ -0,0 +1,40 @@
+import type { RiskPolicySelectionRefusal } from '@cat-factory/contracts'
+import { describe, expect, it } from 'vitest'
+import en from '../../../i18n/locales/en.json'
+import { moveRefusalKey } from './moveRefusal'
+
+/** The thrown shape the contract client produces for a refused reparent (`ApiError.body`). */
+const refused = (reason: string) => ({
+  body: { error: { code: 'forbidden', details: { reason } } },
+})
+
+const REASONS: RiskPolicySelectionRefusal[] = [
+  'relaxes_role_sandbox',
+  'relaxes_role_submission_allowlist',
+  'relaxes_role_class_rule',
+]
+
+describe('moveRefusalKey', () => {
+  it('maps every refusal reason to a key the catalog actually holds', () => {
+    // Derived from the contracts union rather than a list written here, so a new reason fails
+    // this rather than silently reaching the user as the backend's untranslated English.
+    const catalog = (en as { board: { toast: { moveRefused: Record<string, string> } } }).board
+      .toast.moveRefused
+    for (const reason of REASONS) {
+      const key = moveRefusalKey(refused(reason))
+      expect(key, `${reason} has no key`).toBe(`board.toast.moveRefused.${reason}`)
+      expect(catalog[reason], `${reason} has no copy`).toBeTruthy()
+    }
+    // And nothing else: copy for a reason the backend cannot send is copy nobody translates for
+    // a purpose.
+    expect(Object.keys(catalog).sort()).toEqual([...REASONS].sort())
+  })
+
+  it('falls back to the raw message for anything else', () => {
+    // A 403 the guard did not raise, a network fault, a reason a newer backend knows and this
+    // build does not: the backend's own prose is the honest last resort, not a wrong translation.
+    expect(moveRefusalKey(refused('some_future_reason'))).toBeNull()
+    expect(moveRefusalKey({ body: { error: { code: 'forbidden' } } })).toBeNull()
+    expect(moveRefusalKey(new Error('Network down'))).toBeNull()
+  })
+})

package/app/stores/board/moveRefusal.ts

@@ -0,0 +1,34 @@
+import type { RiskPolicySelectionRefusal } from '@cat-factory/contracts'
+import { apiErrorReason } from '~/composables/api/errors'
+
+/**
+ * The translated description for a reparent the backend refused on merge-preset grounds, or
+ * `null` when the failure is anything else.
+ *
+ * A cross-home drag carries a task into another workspace's preset library, which re-decides
+ * whether its runs are sandboxed for the mover's role (ADR 0037), so the backend refuses one that
+ * would drop a restriction they are under. That refusal is a condition a person can act on, and
+ * the backend does not localize prose: it emits the machine-readable `details.reason` and the SPA
+ * maps it here, exactly as `usePipelineErrorToast` maps a conflict's. Without this the drag toast
+ * showed the raw English `ForbiddenError` message to every locale.
+ *
+ * The copy is deliberately NOT the picker's `riskPolicy.picker.refused.*`, which is worded for
+ * someone holding a control: this person picked no policy at all, and telling them about "the
+ * policy you picked" sends them looking for a picker they never touched.
+ *
+ * Keyed on the contracts union so a renamed reason fails the typecheck rather than silently
+ * falling through to the untranslated prose. An unrecognised reason returns `null` and the caller
+ * falls back to the backend's own message, which is the honest last resort.
+ */
+const MOVE_REFUSAL_KEY: Record<RiskPolicySelectionRefusal, string> = {
+  relaxes_role_sandbox: 'board.toast.moveRefused.relaxes_role_sandbox',
+  relaxes_role_submission_allowlist: 'board.toast.moveRefused.relaxes_role_submission_allowlist',
+  relaxes_role_class_rule: 'board.toast.moveRefused.relaxes_role_class_rule',
+}
+
+/** The i18n key for a thrown reparent error's refusal reason, else `null`. */
+export function moveRefusalKey(error: unknown): string | null {
+  const reason = apiErrorReason(error)
+  if (!reason) return null
+  return MOVE_REFUSAL_KEY[reason as RiskPolicySelectionRefusal] ?? null
+}

package/app/stores/board/placement.ts

@@ -2,6 +2,7 @@ import type { UpdateBlockInput } from '@cat-factory/contracts'
 import { useServicesStore } from '~/stores/services'
 import { useWorkspaceStore } from '~/stores/workspace'
 import { createBoardDependencies } from './dependencies'
+import { moveRefusalKey } from './moveRefusal'
 import type { BoardWriteContext } from './context'
 import { UNDO_WINDOW_MS } from './context'
 
@@ -69,9 +70,13 @@ export function createBoardPlacement(ctx: BoardWriteContext) {
     } catch (e) {
       b.parentId = prevParentId
       b.position = prevPosition
+      // A cross-home drag can be refused on merge-preset grounds, which is a condition the mover
+      // can act on rather than a fault. The backend sends the machine-readable reason and no
+      // translated prose, so map it here; anything else keeps the raw message as the last resort.
+      const refusal = moveRefusalKey(e)
       toast.add({
         title: tr('board.toast.moveFailed'),
-        description: e instanceof Error ? e.message : String(e),
+        description: refusal ? tr(refusal) : e instanceof Error ? e.message : String(e),
         icon: 'i-lucide-triangle-alert',
         color: 'error',
       })

package/app/stores/documents.spec.ts

@@ -0,0 +1,156 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { useDocumentsStore } from '~/stores/documents'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { DocumentFreshness, SourceDocument } from '~/types/domain'
+
+// The document store's REFRESH half: what a person gets back when they ask a source whether the
+// copy on the board is still the current one.
+//
+// Two things are worth pinning here rather than leaving to the component. The verdict is kept
+// SEPARATE from the row because it is a statement about a moment, not a property of the projection,
+// so an absent entry has to keep meaning "nobody has asked" (listing documents deliberately probes
+// nothing). And a refresh that pulls a moved page has to reconcile the returned row into the same
+// list every surface reads, or the panel goes on showing the title and excerpt import stored while
+// claiming, one line below, that it just confirmed the newer revision.
+
+function doc(over: Partial<SourceDocument> = {}): SourceDocument {
+  return {
+    source: 'figma',
+    externalId: 'file1:1-2',
+    title: 'Checkout flow',
+    url: 'https://figma.com/design/file1',
+    excerpt: 'Checkout',
+    linkedBlockId: 'task_1',
+    role: null,
+    docKind: null,
+    syncedAt: 1_000,
+    ...over,
+  }
+}
+
+const CONFIRMED: DocumentFreshness = { status: 'confirmed', version: 'v2', change: 'reimported' }
+
+/** The store reads `useApi()` off the auto-import, so each test stubs just what it calls. */
+function stubApi(over: Record<string, unknown>) {
+  vi.stubGlobal('useApi', () => ({
+    listDocuments: () => Promise.resolve([]),
+    ...over,
+  }))
+}
+
+beforeEach(() => {
+  useWorkspaceStore().workspaceId = 'ws1'
+})
+
+describe('documents store: manual refresh', () => {
+  it('reconciles the refreshed row into the list every surface reads', async () => {
+    stubApi({
+      listDocuments: () => Promise.resolve([doc()]),
+      refreshDocument: () =>
+        Promise.resolve({
+          document: doc({ title: 'Checkout flow v2', syncedAt: 2_000 }),
+          freshness: CONFIRMED,
+        }),
+    })
+    const store = useDocumentsStore()
+    await store.loadDocuments()
+
+    await store.refresh('figma', 'file1:1-2')
+
+    // Upserted by `(source, externalId)`, not appended: a refresh must not leave the old title
+    // sitting beside the new one in a picker keyed by the same document.
+    expect(store.documents).toHaveLength(1)
+    expect(store.documents[0]?.title).toBe('Checkout flow v2')
+  })
+
+  it('records the verdict beside the row, and reports "nobody asked" until someone does', async () => {
+    stubApi({
+      refreshDocument: () => Promise.resolve({ document: doc(), freshness: CONFIRMED }),
+    })
+    const store = useDocumentsStore()
+
+    // An unasked document has NO verdict. It must not read as unknown-and-therefore-suspect: a
+    // freshly imported page is fine, it simply has not been re-checked since.
+    expect(store.freshnessFor('figma', 'file1:1-2')).toBeUndefined()
+
+    await store.refresh('figma', 'file1:1-2')
+
+    expect(store.freshnessFor('figma', 'file1:1-2')?.verdict).toEqual(CONFIRMED)
+    // Stamped with WHEN it was reached, because a verdict never expires: what keeps an hour-old
+    // confirmation from rendering as the present state of a page that has had an hour to move is
+    // that the moment travels with it.
+    expect(store.freshnessFor('figma', 'file1:1-2')?.checkedAt).toBeTypeOf('number')
+    // Scoped to the document that was asked about, never to the source.
+    expect(store.freshnessFor('figma', 'other:9-9')).toBeUndefined()
+  })
+
+  it('never shows one board\u2019s verdict against another board\u2019s row', async () => {
+    // The same Figma file can be imported into two boards, and `(source, externalId)` is identical
+    // in both, so a verdict keyed by that pair alone would render board A's "confirmed, revision
+    // v2" against a board B row nobody has ever checked. That breaks the "absent means nobody has
+    // asked" rule in the one direction nothing can notice, since the wrong answer looks like a
+    // right one.
+    stubApi({
+      refreshDocument: () => Promise.resolve({ document: doc(), freshness: CONFIRMED }),
+    })
+    const store = useDocumentsStore()
+    await store.refresh('figma', 'file1:1-2')
+    expect(store.freshnessFor('figma', 'file1:1-2')?.verdict).toEqual(CONFIRMED)
+
+    useWorkspaceStore().workspaceId = 'ws2'
+
+    expect(store.freshnessFor('figma', 'file1:1-2')).toBeUndefined()
+
+    // …and switching back does not lose it: the verdict stays true of the board it was asked on.
+    useWorkspaceStore().workspaceId = 'ws1'
+    expect(store.freshnessFor('figma', 'file1:1-2')?.verdict).toEqual(CONFIRMED)
+  })
+
+  it('does not merge a check that outlived a board switch into the new board\u2019s list', async () => {
+    // The list is the ACTIVE board's and is not keyed by board, so a row arriving after the switch
+    // would be a document from somewhere else appearing on a board that never imported it. The
+    // verdict is still filed, under the board that asked.
+    let resolve!: (v: unknown) => void
+    stubApi({
+      listDocuments: () => Promise.resolve([]),
+      refreshDocument: () =>
+        new Promise((res) => {
+          resolve = res
+        }),
+    })
+    const store = useDocumentsStore()
+    await store.loadDocuments()
+
+    const pending = store.refresh('figma', 'file1:1-2')
+    useWorkspaceStore().workspaceId = 'ws2'
+    resolve({ document: doc(), freshness: CONFIRMED })
+    await pending
+
+    expect(store.documents).toHaveLength(0)
+    useWorkspaceStore().workspaceId = 'ws1'
+    expect(store.freshnessFor('figma', 'file1:1-2')?.verdict).toEqual(CONFIRMED)
+  })
+
+  it('reports in-flight state per document, and clears it when the source refuses', async () => {
+    let reject!: (e: Error) => void
+    stubApi({
+      refreshDocument: () =>
+        new Promise((_res, rej) => {
+          reject = rej
+        }),
+    })
+    const store = useDocumentsStore()
+
+    const pending = store.refresh('figma', 'file1:1-2')
+    expect(store.isRefreshing('figma', 'file1:1-2')).toBe(true)
+    expect(store.isRefreshing('figma', 'other:9-9')).toBe(false)
+
+    reject(new Error('figma 429'))
+    await expect(pending).rejects.toThrow('figma 429')
+
+    // A failure that left the flag set would disable the button that is the whole remedy, and the
+    // person would have no way to try again.
+    expect(store.isRefreshing('figma', 'file1:1-2')).toBe(false)
+    expect(store.freshnessFor('figma', 'file1:1-2')).toBeUndefined()
+  })
+})

package/app/stores/documents.ts

@@ -13,6 +13,7 @@ import type {
   SourceDocument,
 } from '~/types/domain'
 import { isConnectableSource } from '@cat-factory/contracts'
+import { useDocumentFreshness } from '~/composables/useDocumentFreshness'
 import { useSourceIntegration } from '~/composables/useSourceIntegration'
 import { useUpsertList } from '~/composables/useUpsertList'
 import { useWorkspaceStore } from '~/stores/workspace'
@@ -56,6 +57,16 @@ export const useDocumentsStore = defineStore('documents', () => {
   })
   const loading = ref(false)
 
+  // The "is this still the current revision" half, in its own collaborator: a verdict is a
+  // statement about a moment rather than a property of a row, and `useDocumentFreshness` owns why
+  // the two must not merge.
+  const { refresh, freshnessFor, isRefreshing } = useDocumentFreshness({
+    workspaceId: () => workspace.workspaceId,
+    refresh: (source, externalId) =>
+      api.refreshDocument(workspace.requireId(), { source, externalId }),
+    onRefreshed: upsertDoc,
+  })
+
   // Workspace+DocKind template / exemplar role links (WS1). Loaded lazily when the management
   // panel opens; the full list of role-tagged documents across kinds.
   const roleLinks = ref<SourceDocument[]>([])
@@ -224,6 +235,9 @@ export const useDocumentsStore = defineStore('documents', () => {
     loadDocuments,
     resolveRef,
     importDocument,
+    refresh,
+    freshnessFor,
+    isRefreshing,
     search,
     plan,
     spawn,

package/app/types/documents.ts

@@ -15,6 +15,10 @@ export type {
   CredentialField,
   DocumentSourceDescriptor,
   DocumentConnection,
+  DocumentFreshness,
+  DocumentFreshnessChange,
+  DocumentFreshnessGap,
+  RefreshedDocumentView,
   SourceDocument,
   DocumentSearchResult,
   DocumentRefReason,

package/i18n/locales/de.json

@@ -1832,6 +1832,7 @@
         "within_thresholds": "Jede Bewertung liegt innerhalb der {preset}-Schwellenwerte, daher wurde der PR automatisch gemergt.",
         "exceeded_thresholds": "{axes} überschritt die {preset}-Schwellenwerte, daher wartet der PR darauf, dass ein Mensch mergt.",
         "auto_merge_disabled": "Das {preset}-Preset sendet jeden PR an einen Menschen, daher wartet dieser auf Prüfung.",
+        "no_policy_configured": "Für diesen Lauf galt keine Merge-Richtlinie, daher wird kein PR selbstständig gemergt. Diese Installation hat keine Merge-Preset-Bibliothek eingerichtet; das kann nur ein Betreiber ändern.",
         "no_rationale": "Der Merger hat den PR bewertet, aber keine Begründung gegeben, daher konnte dem Urteil zum automatischen Mergen nicht vertraut werden; der PR wartet darauf, dass ein Mensch mergt.",
         "no_assessment": "Der Merger hat keine parsbare Bewertung zurückgegeben, daher wartet der PR darauf, dass ein Mensch mergt.",
         "merge_failed": "Die Bewertungen lagen innerhalb der {preset}-Schwellenwerte, aber der automatische Merge konnte nicht abgeschlossen werden (zum Beispiel Branch-Schutz oder ein Konflikt), daher wartet der PR darauf, dass ein Mensch mergt.",
@@ -1997,6 +1998,15 @@
           "oauthTokenFailed": "war nicht verfügbar: die Verbindung liefert kein Zugriffstoken mehr.",
           "overBudget": "war nicht verfügbar: dieser Agent deklariert mehr Tool-Server, als ein Lauf mitführt.",
           "unknown": "war nicht verfügbar ({reason})."
+        },
+        "remedy": {
+          "harnessUnsupported": "Führen Sie den Schritt auf einer Agenten-CLI mit MCP aus, oder erweitern Sie die Harness-Liste des Servers.",
+          "transportUnsupported": "Deklarieren Sie dafür einen stdio-Server, oder führen Sie den Schritt auf einer Agenten-CLI aus, die HTTP-Server erreicht.",
+          "missingSecret": "Hinterlegen Sie die genannte Zugangsinformation im Infrastruktur-Fenster unter den Capability-Zugangsdaten.",
+          "reservedSecret": "Ändern Sie die Deklaration auf einen anderen Schlüssel; das Setzen dieser Variablen hilft gerade nicht.",
+          "oauthNotConnected": "Verbinden Sie dieses Board im Infrastruktur-Fenster damit.",
+          "oauthTokenFailed": "Verbinden Sie es im Infrastruktur-Fenster neu, oder warten Sie die Störung des Anbieters ab.",
+          "overBudget": "Kürzen Sie, was der Agent deklariert, damit ein Lauf alles mitführen kann."
         }
       },
       "adherence": {
@@ -2204,7 +2214,9 @@
       },
       "members": {
         "title": "Mitglieder",
-        "empty": "Noch keine Mitglieder."
+        "empty": "Noch keine Mitglieder.",
+        "revokeSessions": "Auf allen Geräten abmelden",
+        "sessionsRevoked": "Auf allen Geräten abgemeldet"
       },
       "invite": {
         "title": "Ein Teammitglied einladen",
@@ -2243,7 +2255,8 @@
         "sendInvite": "Einladung konnte nicht gesendet werden",
         "revokeInvite": "Einladung konnte nicht widerrufen werden",
         "connectEmail": "E-Mail-Absender konnte nicht verbunden werden",
-        "disconnectEmail": "E-Mail-Absender konnte nicht getrennt werden"
+        "disconnectEmail": "E-Mail-Absender konnte nicht getrennt werden",
+        "revokeSessions": "Mitglied konnte nicht abgemeldet werden"
       },
       "emailNoun": "E-Mail-Versand"
     },
@@ -2653,6 +2666,39 @@
     },
     "accountFoundational": {
       "intro": "Die gemeinsamen Fähigkeiten, die diese Organisation bereits betreibt - Dateiablage, Benachrichtigungen, Audit - samt ihren API-Verträgen. Jedes Board erbt sie, und einem Architekten wird gesagt, sie zu nutzen statt einen Neubau vorzuschlagen. Dienste, die dieses Deployment im Code registriert, werden hier ebenfalls geerbt und können per ID überschrieben oder unten abgewählt werden."
+    },
+    "auditLog": {
+      "title": "Prüfprotokoll",
+      "description": "Wer in diesem Konto was und wann geändert hat. Einträge werden nur angehängt und können weder bearbeitet noch gelöscht werden.",
+      "empty": "Für dieses Konto wurde bisher nichts aufgezeichnet.",
+      "loadMore": "Ältere Einträge laden",
+      "refresh": "Aktualisieren",
+      "retiredAction": "hat eine Aktion ausgeführt, die diese Version nicht mehr kennt ({action})",
+      "actors": {
+        "system": "Das System",
+        "apiKey": "API-Schlüssel {id}"
+      },
+      "values": {
+        "none": "keine"
+      },
+      "actions": {
+        "accountMemberAdded": "hat {target} als {roles} zum Konto hinzugefügt",
+        "accountMemberRolesChanged": "hat die Rollen von {target} von {previousRoles} zu {roles} geändert",
+        "accountBudgetChanged": "hat das monatliche Ausgabenlimit auf {limit} gesetzt",
+        "accountSettingsChanged": "hat den Standard-Cloud-Anbieter auf {defaultCloudProvider} gesetzt",
+        "accountInvitationCreated": "hat {email} als {roles} eingeladen",
+        "accountInvitationRevoked": "hat die Einladung für {email} zurückgezogen",
+        "accountInvitationAccepted": "hat die Einladung für {email} als {roles} angenommen",
+        "accountMemberSessionsRevoked": "hat {target} auf allen Geräten abgemeldet",
+        "workspaceMemberAdded": "hat {target} als {role} zu einem Board hinzugefügt",
+        "workspaceMemberRoleChanged": "hat die Board-Rolle von {target} von {previousRole} zu {role} geändert",
+        "workspaceMemberRemoved": "hat {target} aus einem Board entfernt (war {role})",
+        "workspaceAccessModeChanged": "hat den Board-Zugriff auf {accessMode} gesetzt"
+      },
+      "errors": {
+        "load": "Das Prüfprotokoll konnte nicht geladen werden.",
+        "loadMore": "Ältere Einträge konnten nicht geladen werden"
+      }
     }
   },
   "board": {
@@ -2670,7 +2716,12 @@
       "archived": "Archiviert: „{name}“",
       "restored": "Wiederhergestellt: „{name}“",
       "archiveFailed": "Dienst konnte nicht archiviert werden",
-      "restoreFailed": "Dienst konnte nicht wiederhergestellt werden"
+      "restoreFailed": "Dienst konnte nicht wiederhergestellt werden",
+      "moveRefused": {
+        "relaxes_role_sandbox": "Die Ausführungen dieser Aufgabe laufen an ihrem jetzigen Ort für deine Rolle isoliert, die Merge-Richtlinie am Zielort jedoch nicht. Bitte eine Workspace-Administration, sie zu verschieben.",
+        "relaxes_role_submission_allowlist": "Die Merge-Richtlinie am Zielort würde dich Änderungsarten mergen lassen, die dir hier verwehrt sind. Bitte eine Workspace-Administration, sie zu verschieben.",
+        "relaxes_role_class_rule": "Die Merge-Richtlinie am Zielort merged Änderungen automatisch, die du hier prüfen musst. Bitte eine Workspace-Administration, sie zu verschieben."
+      }
     },
     "repoTypes": {
       "service": "Service",
@@ -3840,6 +3891,25 @@
       "imported": "\"{title}\" importiert",
       "importFailed": "Import fehlgeschlagen"
     },
+    "freshness": {
+      "updated": "Aktualisiert am {when}",
+      "refresh": "Auf Änderungen prüfen",
+      "change": {
+        "unchanged": "Stimmt mit der Quelle überein",
+        "reimported": "Neuere Fassung übernommen",
+        "revision_only": "Die Quelle hat sich geändert, diese Kopie jedoch nicht"
+      },
+      "checkedAt": "Geprüft am {when}",
+      "revision": "Revision {version}",
+      "notApplicable": "Diese Installation hat keinen Leser für diese Quelle, es gibt also nichts zum Abgleichen.",
+      "gap": {
+        "not_connected": "Nicht geprüft: dieser Workspace ist nicht mehr mit der Quelle verbunden.",
+        "credentials_unreadable": "Nicht geprüft: diese Installation kann die Zugangsdaten der Quelle nicht lesen.",
+        "unversioned": "Nicht geprüft: die Quelle veröffentlicht keine Revision zum Vergleich.",
+        "source_unreachable": "Nicht geprüft: die Quelle war nicht erreichbar."
+      },
+      "refreshFailed": "Prüfung auf Änderungen fehlgeschlagen"
+    },
     "connect": {
       "title": "Quelle verbinden",
       "sourceFallback": "Quelle",

package/i18n/locales/en.json

@@ -171,7 +171,12 @@
       "archived": "Archived \"{name}\"",
       "restored": "Restored \"{name}\"",
       "archiveFailed": "Couldn't archive the service",
-      "restoreFailed": "Couldn't restore the service"
+      "restoreFailed": "Couldn't restore the service",
+      "moveRefused": {
+        "relaxes_role_sandbox": "This task’s runs are sandboxed for your role where it is now, and the merge policy governing it where you are moving it is not. Ask a workspace admin to move it.",
+        "relaxes_role_submission_allowlist": "The merge policy where you are moving this task would let you land kinds of change it holds you back from here. Ask a workspace admin to move it.",
+        "relaxes_role_class_rule": "The merge policy where you are moving this task auto-merges changes you are held to review on it here. Ask a workspace admin to move it."
+      }
     },
     "repoTypes": {
       "service": "Service",
@@ -1351,6 +1356,7 @@
         "within_thresholds": "Every score is within the {preset} thresholds, so the PR was merged automatically.",
         "exceeded_thresholds": "{axes} exceeded the {preset} thresholds, so the PR is waiting for a human to merge.",
         "auto_merge_disabled": "The {preset} preset sends every PR to a human, so this one is waiting for review.",
+        "no_policy_configured": "No merge policy governed this run, so no PR merges on its own. This deployment has no merge preset library set up, which an operator has to fix.",
         "no_rationale": "The merger scored the PR but gave no rationale, so the verdict could not be trusted to auto-merge; the PR is waiting for a human to merge.",
         "no_assessment": "The merger did not return a parseable assessment, so the PR is waiting for a human to merge.",
         "merge_failed": "The scores were within the {preset} thresholds, but the automatic merge could not complete (for example branch protection or a conflict), so the PR is waiting for a human to merge.",
@@ -1519,6 +1525,15 @@
           "oauthTokenFailed": "was not available: the connection stopped producing an access token.",
           "overBudget": "was not available: this agent declares more tool servers than one run carries.",
           "unknown": "was not available ({reason})."
+        },
+        "remedy": {
+          "harnessUnsupported": "Run the step on an agent CLI that speaks MCP, or widen the server's harness list.",
+          "transportUnsupported": "Declare a stdio server for it, or run the step on an agent CLI that reaches HTTP servers.",
+          "missingSecret": "Set the credential it names under capability credentials, in the Infrastructure window.",
+          "reservedSecret": "Change the declaration to ask for another key; setting that variable is exactly what will not help.",
+          "oauthNotConnected": "Connect this board to it from the Infrastructure window.",
+          "oauthTokenFailed": "Reconnect it from the Infrastructure window, or wait out the vendor's outage.",
+          "overBudget": "Trim what the agent declares, so one run can carry all of it."
         }
       },
       "adherence": {
@@ -2127,7 +2142,9 @@
       },
       "members": {
         "title": "Members",
-        "empty": "No members yet."
+        "empty": "No members yet.",
+        "revokeSessions": "Sign out of every device",
+        "sessionsRevoked": "Signed out of every device"
       },
       "invite": {
         "title": "Invite a teammate",
@@ -2166,7 +2183,8 @@
         "sendInvite": "Could not send invitation",
         "revokeInvite": "Could not revoke invitation",
         "connectEmail": "Could not connect email sender",
-        "disconnectEmail": "Could not disconnect email sender"
+        "disconnectEmail": "Could not disconnect email sender",
+        "revokeSessions": "Could not sign the member out"
       },
       "emailNoun": "email sending"
     },
@@ -2576,6 +2594,39 @@
     },
     "accountFoundational": {
       "intro": "The shared capabilities this organisation already runs - file storage, notifications, audit - with their API contracts. Every board inherits them, and an architect is told to consume them instead of proposing a rebuild. Services this deployment registers in code are inherited here too, and can be overridden by id or opted out of below."
+    },
+    "auditLog": {
+      "title": "Audit log",
+      "description": "Who changed what in this account, and when. Records are append-only and cannot be edited or deleted.",
+      "empty": "Nothing has been recorded for this account yet.",
+      "loadMore": "Load older entries",
+      "refresh": "Refresh",
+      "retiredAction": "performed an action this version no longer recognises ({action})",
+      "actors": {
+        "system": "The system",
+        "apiKey": "API key {id}"
+      },
+      "values": {
+        "none": "none"
+      },
+      "actions": {
+        "accountMemberAdded": "added {target} to the account as {roles}",
+        "accountMemberRolesChanged": "changed the roles of {target} from {previousRoles} to {roles}",
+        "accountBudgetChanged": "set the monthly spending limit to {limit}",
+        "accountSettingsChanged": "set the default cloud provider to {defaultCloudProvider}",
+        "accountInvitationCreated": "invited {email} as {roles}",
+        "accountInvitationRevoked": "revoked the invitation for {email}",
+        "accountInvitationAccepted": "accepted the invitation for {email} as {roles}",
+        "accountMemberSessionsRevoked": "signed {target} out of every device",
+        "workspaceMemberAdded": "added {target} to a board as {role}",
+        "workspaceMemberRoleChanged": "changed the board role of {target} from {previousRole} to {role}",
+        "workspaceMemberRemoved": "removed {target} from a board (they were {role})",
+        "workspaceAccessModeChanged": "set board access to {accessMode}"
+      },
+      "errors": {
+        "load": "The audit log could not be loaded.",
+        "loadMore": "Could not load older entries"
+      }
     }
   },
   "settings": {
@@ -4360,6 +4411,25 @@
       "imported": "Imported \"{title}\"",
       "importFailed": "Import failed"
     },
+    "freshness": {
+      "updated": "Updated {when}",
+      "refresh": "Check for changes",
+      "change": {
+        "unchanged": "Matches the source",
+        "reimported": "Pulled the newer version",
+        "revision_only": "The source moved on, but this copy is unchanged"
+      },
+      "checkedAt": "Checked {when}",
+      "revision": "Revision {version}",
+      "notApplicable": "This deployment has no reader for that source, so there is nothing to check against.",
+      "gap": {
+        "not_connected": "Not checked: this workspace is no longer connected to the source.",
+        "credentials_unreadable": "Not checked: this deployment cannot read the source credentials.",
+        "unversioned": "Not checked: the source publishes no revision to compare against.",
+        "source_unreachable": "Not checked: the source could not be reached."
+      },
+      "refreshFailed": "Could not check for changes"
+    },
     "connect": {
       "title": "Connect source",
       "sourceFallback": "Source",