@k2b/cloud 0.40.0 → 0.41.0

package/src/ai/types.ts

@@ -13,7 +13,12 @@ import type {
 import type { Usage } from "@k2b/nessi/ai";
 import type { z } from "zod";
 import type { CapabilitySentenceField } from "../_internal/capability-sentences";
-import type { CapabilityActionReviewData, CapabilityActionSentences, CloudResourceRef } from "../contracts/capabilities";
+import type {
+  CapabilityActionCallReview,
+  CapabilityActionReviewData,
+  CapabilityActionSentences,
+  CloudResourceRef,
+} from "../contracts/capabilities";
 import type { RequestActor } from "../server";
 import type { AiActionCheck, AiStoredActionReview } from "./action-review";
 import type { AiLocalClient, AiLocalContext, AiLocalToolName } from "./local-tool-contracts";
@@ -451,7 +456,14 @@ export type AiPendingTurnAction =
       name: string;
       args: unknown;
       message?: string;
+      /** Stored review, including the declared ask reason for new-shape reviews. */
       review?: CapabilityActionReviewData;
+      /** Owning application, with its registry name in the turn's request locale. */
+      app?: { id: string; name: string };
+      /** The chat's current title, when known. */
+      chatTitle?: string | null;
+      /** Expiry of the platform approval request, as an ISO timestamp. */
+      expiresAt?: string;
       allowAlways: boolean;
       /** Whether the approval can be remembered for this chat. */
       allowChat: boolean;
@@ -1032,6 +1044,8 @@ export type AiConversationService = {
   getPendingTurnAction(input: { conversationId: string; turnId: string; callId: string }): Promise<AiPendingTurnActionRecord | null>;
   findPendingTurnActionByApproval(input: { approvalId: string; ownerUserId: string }): Promise<AiPendingTurnActionRecord | null>;
   listPendingActionRecords(input: { conversationId: string; turnId: string }): Promise<AiPendingTurnActionRecord[]>;
+  /** The reviews Cloud stored with a turn's tool calls, keyed by call ID; the newest message wins. */
+  listTurnToolReviews(input: { conversationId: string; turnId: string }): Promise<Map<string, AiStoredActionReview>>;
   listResolvedPendingActions(input: { conversationId: string; turnId: string }): Promise<AiPendingTurnActionRecord[]>;
   resolvePendingTurnAction(input: {
     conversationId: string;
@@ -1151,7 +1165,7 @@ export type AiToolRuntime<TInput extends z.ZodType = z.ZodType, TOutput extends
           /** Localized short status; never include payloads or secrets. */
           reportProgress?: (message: string) => Promise<void>;
           /** Asks like `requestApproval`, and lets the person remember the approval of `target`. */
-          requestApprovalFor?: (message: string, target: AiApprovalTarget) => Promise<boolean>;
+          requestApprovalFor?: (message: string, target: AiApprovalTarget, review?: CapabilityActionCallReview) => Promise<boolean>;
           /** Relays a decision for an effect another platform component consumes and executes. */
           requestRelayedApproval?: (message: string, options: { approvalId?: string; target?: AiApprovalTarget }) => Promise<boolean>;
           /** Shows requests a website approval let through as they go out, so the chat keeps them whatever the outcome. */

package/src/api/app-approval-actions.ts

@@ -1,20 +1,44 @@
 import { submitAiTurnAction } from "../ai/runtime";
 import { aiConversations } from "../ai/store";
-import { APP_ACTION_LIMITS } from "../contracts/app-approval";
+import { APP_ACTION_LIMITS, type AppActionSummary } from "../contracts/app-approval";
+import { APPROVALS_PAGE_SIZE } from "../contracts/approvals";
 import type { AppDeviceActions } from "../services/app-approval";
-import { listPending } from "../services/approvals";
-import { appActionSummary, appActionView } from "../services/approvals/device";
+import { listPending, loadApprovalActionPolicies, pendingApprovalCard } from "../services/approvals";
+import { appActionOffered, appActionSummary, appActionView } from "../services/approvals/device";
+
+/** Pages of open requests one inbox poll reads at most while it skips browser-only questions. */
+const INBOX_PAGES = 5;
 
 export const createDeviceActions = (appName: (appId: string, locale: string) => string): AppDeviceActions => {
   const view: AppDeviceActions["view"] = async ({ userId, issuer, actionId }) => {
     const { items } = await listPending({ approverUserId: userId, id: actionId, limit: 1 });
-    return items[0] ? appActionView(items[0], { issuer, appName }) : null;
+    const row = items[0];
+    if (!row) return null;
+    const policy = (await loadApprovalActionPolicies([row]))(row);
+    const mapped = await appActionView(row, { issuer, appName, policy });
+    return appActionOffered(mapped, pendingApprovalCard(row, appName, policy), policy) ? mapped : null;
   };
   return {
     inbox: async ({ userId, issuer }) => {
-      const { items, count } = await listPending({ approverUserId: userId, limit: APP_ACTION_LIMITS.inboxActions });
-      const views = await Promise.all(items.map((row) => appActionView(row, { issuer, appName })));
-      return { actions: views.map(appActionSummary), moreActions: Math.max(0, count - items.length) };
+      // Browser-only questions are skipped, so read on past them. One poll reads at most this many pages of open
+      // requests, newest first, which keeps each 5-second poll bounded.
+      const actions: AppActionSummary[] = [];
+      let count = 0;
+      let cursor: string | undefined;
+      for (let page = 0; page < INBOX_PAGES && actions.length < APP_ACTION_LIMITS.inboxActions; page += 1) {
+        const result = await listPending({ approverUserId: userId, limit: APPROVALS_PAGE_SIZE, ...(cursor ? { cursor } : {}) });
+        count = result.count;
+        const policyOf = await loadApprovalActionPolicies(result.items);
+        for (const row of result.items) {
+          const policy = policyOf(row);
+          const mapped = await appActionView(row, { issuer, appName, policy });
+          if (appActionOffered(mapped, pendingApprovalCard(row, appName, policy), policy)) actions.push(appActionSummary(mapped));
+          if (actions.length === APP_ACTION_LIMITS.inboxActions) break;
+        }
+        if (!result.nextCursor) break;
+        cursor = result.nextCursor;
+      }
+      return { actions, moreActions: Math.max(0, count - actions.length) };
     },
     view,
     decide: async ({ userId, deviceId, issuer, actionId, digest, approved }) => {

package/src/api/auth/schemas.ts

@@ -54,6 +54,9 @@ export const AuthResponseSchema = z.object({
   user: UserSchema,
 });
 
+/** Password-change sign-in result; retry ending other sign-ins when signOutOthersFailed is true. */
+export const PasswordChangeAuthResponseSchema = AuthResponseSchema.extend({ signOutOthersFailed: z.boolean() });
+
 export const VerifyPasskeyAuthenticationSchema = z.object({
   response: z.unknown(),
   acceptedAgb: z.literal(true).optional(),

package/src/api/auth.ts

@@ -9,6 +9,7 @@ import { accounts, audit, authFlows, getFreeIpaConfig, logger, webauthn } from "
 import { isAccountCategoryAllowed } from "../services/account-category-policy";
 import type { AuthNotificationSender } from "../services/auth-flows/notification-sender";
 import { legalConsent } from "../services/legal-consent";
+import { SessionEpochChangedError } from "../services/session";
 import * as categorySettings from "../services/settings";
 import { publicCloudOrigin } from "../shared/app-url";
 
@@ -20,6 +21,7 @@ import {
   AuthResponseSchema,
   EmailLoginSchema,
   LoginSchema,
+  PasswordChangeAuthResponseSchema,
   PasswordResetCompleteSchema,
   PasswordResetRequestSchema,
   VerifyPasskeyAuthenticationSchema,
@@ -52,6 +54,7 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         responses: {
           200: jsonResponse(AuthResponseSchema, "Login successful"),
           401: jsonResponse(ErrorResponseSchema, "Invalid username or password"),
+          409: jsonResponse(ErrorResponseSchema, "Signed out everywhere while signing in; sign in again"),
           503: jsonResponse(ErrorResponseSchema, "FreeIPA unavailable"),
         },
       }),
@@ -76,10 +79,18 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         }
 
         // Issue through the configured migration gate (legacy opaque or JWT family).
-        const sessionToken = await auth.session.create(c, loginResult.userId, {
-          method: "password",
-          notify: notificationSender.sendNewBrowserSignIn,
-        });
+        let sessionToken: string;
+        try {
+          sessionToken = await auth.session.create(c, loginResult.userId, {
+            method: "password",
+            notify: notificationSender.sendNewBrowserSignIn,
+            authEpoch: loginResult.authEpoch,
+          });
+        } catch (error) {
+          if (error instanceof SessionEpochChangedError)
+            return c.json({ message: "You were signed out everywhere while signing in. Sign in again." }, 409);
+          throw error;
+        }
 
         log.info("Login successful", { uid: loginResult.user.uid });
         return c.json({
@@ -153,10 +164,11 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         tags: ["Auth"],
         summary: "Change expired password",
         description:
-          "Change an expired or temporary password using FreeIPA's change_password endpoint. No active session required. For regular password changes of a logged-in user, use POST /api/me/password instead.",
+          "Change an expired or temporary password using FreeIPA's change_password endpoint. Ends the account's existing sign-ins before creating the new browser session. When signOutOthersFailed is true, the new browser session is issued and the client retries POST /api/me/sign-ins/sign-out-others. No active session required. For regular password changes of a logged-in user, use POST /api/me/password instead.",
         responses: {
-          200: jsonResponse(AuthResponseSchema, "Password changed and logged in"),
+          200: jsonResponse(PasswordChangeAuthResponseSchema, "Password changed and logged in"),
           400: jsonResponse(ErrorResponseSchema, "Failed to change password"),
+          409: jsonResponse(ErrorResponseSchema, "Password changed, but signed out everywhere while signing in; sign in again"),
           503: jsonResponse(ErrorResponseSchema, "FreeIPA unavailable"),
         },
       }),
@@ -183,13 +195,24 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return jsonError(c, changeResult.message, changeResult.status === 401 ? 401 : 400);
         }
 
-        const sessionToken = await auth.session.create(c, changeResult.userId, {
-          method: "expired_password",
-          notify: notificationSender.sendNewBrowserSignIn,
-        });
+        let sessionToken: string;
+        try {
+          sessionToken = await auth.session.create(c, changeResult.userId, {
+            method: "expired_password",
+            notify: notificationSender.sendNewBrowserSignIn,
+            authEpoch: changeResult.authEpoch,
+          });
+        } catch (error) {
+          if (error instanceof SessionEpochChangedError)
+            return c.json(
+              { message: "Your password was changed, but you were signed out everywhere while signing in. Sign in again." },
+              409,
+            );
+          throw error;
+        }
 
         log.info("Password changed via expired flow", { uid: username });
-        return c.json({ session_token: sessionToken, user: changeResult.user });
+        return c.json({ session_token: sessionToken, user: changeResult.user, signOutOthersFailed: changeResult.signOutOthersFailed });
       },
     )
     .post(
@@ -278,11 +301,13 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
         tags: ["Auth"],
         summary: "Complete password reset",
         description:
-          "Set a new password using a one-time reset token. Creates a normal Cloud session only after the password was changed successfully.",
+          "Use a one-time reset token to first sign the account out everywhere, including unpairing Cloud Login and mobile app phones, then set the password, sign out everywhere again and create the new browser session. If signing out everywhere fails before the change, the password stays unchanged; if it fails after the change, no session is issued. Both answer 500, and a new reset link is required. signOutOthersFailed is false whenever a session is issued.",
         responses: {
-          200: jsonResponse(AuthResponseSchema, "Password reset completed and session created"),
+          200: jsonResponse(PasswordChangeAuthResponseSchema, "Password reset completed and session created"),
           400: jsonResponse(ErrorResponseSchema, "Password reset failed"),
           401: jsonResponse(ErrorResponseSchema, "Invalid or expired reset token"),
+          409: jsonResponse(ErrorResponseSchema, "Password changed, but signed out everywhere while signing in; sign in again"),
+          500: jsonResponse(ErrorResponseSchema, "Password reset failed"),
         },
       }),
       v("json", PasswordResetCompleteSchema),
@@ -301,12 +326,23 @@ export const createAuthRoutes = (notificationSender: AuthNotificationSender) =>
           return jsonError(c, result.message, status);
         }
 
-        const sessionToken = await auth.session.create(c, result.userId, {
-          method: "password_reset",
-          notify: notificationSender.sendNewBrowserSignIn,
-        });
+        let sessionToken: string;
+        try {
+          sessionToken = await auth.session.create(c, result.userId, {
+            method: "password_reset",
+            notify: notificationSender.sendNewBrowserSignIn,
+            authEpoch: result.authEpoch,
+          });
+        } catch (error) {
+          if (error instanceof SessionEpochChangedError)
+            return c.json(
+              { message: "Your password was changed, but you were signed out everywhere while signing in. Sign in again." },
+              409,
+            );
+          throw error;
+        }
         log.info("Password reset completed", { uid: result.user.uid });
-        return c.json({ user: result.user, session_token: sessionToken });
+        return c.json({ user: result.user, session_token: sessionToken, signOutOthersFailed: result.signOutOthersFailed });
       },
     )
     .post(

package/src/api/mcp.ts

@@ -15,6 +15,7 @@ import {
 import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { readBoundedJson } from "../_internal/bounded-json";
+import { capabilitySentenceText } from "../_internal/capability-sentences";
 import {
   HELP_SEARCH_MAX_LIMIT,
   helpAgentMarkdown,
@@ -31,6 +32,7 @@ import {
   CAPABILITY_MAX_RESULT_BYTES,
   CAPABILITY_PROTOCOL_VERSION,
   type CapabilityActionManifest,
+  CapabilityActionReceiptSchema,
   type CapabilityQueryManifest,
   CapabilitySemanticLinkSchema,
   type CloudResourceRef,
@@ -42,12 +44,14 @@ import {
 } from "../contracts/capabilities";
 import type { AppRegistryEntry, CapabilityRegistryEntry } from "../contracts/registry";
 import { type AuthContext, auth, type RequestAuthority, rateLimit, rejectReservedWorkloadCredential, resolveLocale } from "../server";
+import { preferredLocale } from "../server/locale";
 import { noTransform } from "../server/middleware/no-transform";
 import { createHelpReader, type HelpArticle, type HelpMetadata, type HelpReader, type HelpReaderFactory } from "../services/help";
 import { normalizeInvocationRequestId } from "../services/identity/invocation-token";
 import { logger } from "../services/logging";
 import { get } from "../services/settings";
 import { cloudMcpResourceUri, publicCloudOrigin } from "../shared/app-url";
+import { normalizeTimeZone } from "../shared/time";
 import { type CapabilityDispatchDependencies, dispatchCapability } from "./capabilities";
 
 const MCP_TOOL_PAGE_SIZE = 100;
@@ -67,6 +71,7 @@ type McpRouteDependencies = CapabilityDispatchDependencies & {
   listApps?: () => Promise<AppRegistryEntry[]>;
   help?: HelpReaderFactory;
   getOperatorLocale?: () => Promise<string | undefined>;
+  getOperatorTimeZone?: () => Promise<string | undefined>;
   getAppUrl?: () => Promise<string>;
   authenticate?: MiddlewareHandler<AuthContext>;
   limit?: MiddlewareHandler<AuthContext>;
@@ -682,14 +687,33 @@ const createMcpServer = (
         origin,
       );
     }
-    const resultFor = (value: Record<string, unknown>): CallToolResult => {
+    const receipt = response.ok && selected.kind === "actions" ? CapabilityActionReceiptSchema.safeParse(body.receipt) : null;
+    let receiptText: string | undefined;
+    if (receipt?.success) {
+      // The receipt line is extra presentation: if Cloud cannot word it, the completed Action's result still goes out.
+      try {
+        const locale = preferredLocale(request.headers) ?? (await resolveHelpLocale());
+        const timeZone = normalizeTimeZone(
+          await (dependencies.getOperatorTimeZone ?? (() => get<string>("app.timezone")))().catch(() => "UTC"),
+        );
+        receiptText = capabilitySentenceText(receipt.data.text, receipt.data.slots ?? {}, { locale, timeZone });
+      } catch (error) {
+        log.warn("MCP receipt text unavailable", { error: error instanceof Error ? error.message : String(error) });
+      }
+    }
+    const resultFor = (value: Record<string, unknown>, withReceipt = true): CallToolResult => {
       const result = toolResult(value, !response.ok);
       if (origin) result.content.push(...semanticResourceLinks(value, origin));
+      if (withReceipt && receiptText) result.content.unshift({ type: "text", text: receiptText });
       return result;
     };
-    // Added hrefs are optional: they never turn a result that fits into RESPONSE_TOO_LARGE.
+    // Both enrichments are optional: neither turns a result that fits into RESPONSE_TOO_LARGE.
     const result = resultFor(body);
-    return ensureBoundedToolResult(fitsToolResult(result) || body === providerBody ? result : resultFor(providerBody));
+    if (fitsToolResult(result)) return result;
+    const plain = resultFor(body, false);
+    if (fitsToolResult(plain)) return plain;
+    const original = resultFor(providerBody);
+    return ensureBoundedToolResult(fitsToolResult(original) ? original : resultFor(providerBody, false));
   });
 
   return server;

package/src/api/me.ts

@@ -7,6 +7,7 @@
 import { err, fail, ok, type Result } from "@k2b/stdlib";
 import { sql } from "bun";
 import { type Context, Hono, type MiddlewareHandler } from "hono";
+import { deleteCookie } from "hono/cookie";
 import { createMiddleware } from "hono/factory";
 import { describeRoute } from "hono-openapi";
 import { z } from "zod";
@@ -27,6 +28,7 @@ import {
   NotificationQuietSettingsSchema,
   RegisterBrowserNotificationEndpointSchema,
   ServiceAccountCredentialSchema,
+  SignOutOthersResponseSchema,
   UpdateAvatarResponseSchema,
   UpdateAvatarSchema,
   UpdateNotificationQuietSettingsSchema,
@@ -47,6 +49,7 @@ import {
   accountsAppService as accountsService,
   audit,
   browserNotifications,
+  logger,
   mandates,
   notifications,
   serviceAccountCredentials,
@@ -61,6 +64,8 @@ import { createMePanelConsentRoutes } from "./me-panel-consent";
 import { createMeRailRoutes } from "./me-rail";
 import { createMeWebVitalsRoutes } from "./me-web-vitals";
 
+const log = logger("api:me");
+
 const toAccountsActor = (user: AuthContext["Variables"]["user"]) => ({
   userId: user.id,
   uid: user.uid,
@@ -747,25 +752,96 @@ const app = new Hono<AuthContext>()
     describeRoute({
       tags: ["Me"],
       summary: "Change current user password",
-      description: "Change the authenticated user's password. Requires the current password for verification.",
+      description:
+        "Change the authenticated user's password and end every other sign-in. Requires the current password. The current browser stays signed in with a new cookie and its original sign-in time. signInAgain is true when the caller must sign in again: this browser could not be kept, or the request did not come from a browser sign-in.",
       ...requiresAuth,
       responses: {
-        200: jsonResponse(MessageResponseSchema, "Password changed"),
+        200: jsonResponse(SignOutOthersResponseSchema, "Password changed"),
         400: jsonResponse(ErrorResponseSchema, "Failed to change password"),
         401: jsonResponse(ErrorResponseSchema, "Current password is incorrect"),
+        500: jsonResponse(
+          ErrorResponseSchema,
+          "Password changed, but signing out other sign-ins failed (SIGN_OUT_OTHERS_FAILED). Retry POST /api/me/sign-ins/sign-out-others.",
+        ),
         403: jsonResponse(ErrorResponseSchema, "Not permitted for API keys or other credentials"),
       },
     }),
     v("json", ChangePasswordSchema),
     async (c) =>
       respond(c, async () => {
+        const keep = await auth.browserSignIn(c);
         const result = await accountsService.user.changeOwnPassword({
+          keep: keep && { sid: keep.sid, authEpoch: keep.authEpoch },
           user: c.get("user"),
           currentPassword: c.req.valid("json").currentPassword,
           newPassword: c.req.valid("json").newPassword,
         });
         if (!result.ok) return result;
-        return ok({ message: "Password changed successfully." });
+        if (result.data.kept) auth.session.setWebCookie(c, result.data.kept.token, result.data.kept.expiresAt);
+        const signInAgain = !result.data.kept;
+        if (keep && signInAgain) deleteCookie(c, "session_token", { path: "/" });
+        return ok({
+          message: signInAgain
+            ? keep
+              ? "Password changed. You are signed out everywhere, including this browser. Sign in again."
+              : "Password changed. You are signed out everywhere. Sign in again."
+            : "Password changed successfully.",
+          signInAgain,
+        });
+      }),
+  )
+
+  .post(
+    "/sign-ins/sign-out-others",
+    auth.rejectAppSession,
+    requireBrowserSignIn,
+    describeRoute({
+      tags: ["Me"],
+      summary: "Sign out every other sign-in",
+      description:
+        "End other sign-ins and rotate this browser's cookie while preserving its sign-in time and expiry; signInAgain is true if this browser could not be kept. Cloud Login phones stay paired. API keys, passkeys and mandates stay valid.",
+      ...requiresAuth,
+      responses: {
+        200: jsonResponse(SignOutOthersResponseSchema, "Other sign-ins ended"),
+        401: jsonResponse(ErrorResponseSchema, "Authentication required"),
+        403: jsonResponse(
+          ErrorResponseSchema,
+          "Browser sign-in required (BROWSER_SIGN_IN_REQUIRED); mobile app sessions receive FORBIDDEN",
+        ),
+        500: jsonResponse(ErrorResponseSchema, "Signing out other sign-ins failed (SIGN_OUT_OTHERS_FAILED)"),
+      },
+    }),
+    async (c) =>
+      respond(c, async () => {
+        const signIn = await auth.browserSignIn(c);
+        if (!signIn) throw new Error("Browser sign-in gate was not applied");
+        try {
+          const { kept } = await auth.session.endOtherSignIns(c.get("user").id, {
+            keep: { sid: signIn.sid, authEpoch: signIn.authEpoch },
+            reason: "sign_out_others",
+          });
+          const user = c.get("user");
+          try {
+            await audit.record({
+              action: "auth.session.sign_out_others",
+              outcome: "allowed",
+              actor: toAccountsActor(user),
+              target: { type: "user", id: user.id, label: user.uid, provider: user.provider },
+              metadata: { keptThisBrowser: !!kept },
+            });
+          } catch {
+            log.warn("Other sign-ins ended, but recording the audit event failed", { userId: user.id });
+          }
+          if (kept) auth.session.setWebCookie(c, kept.token, kept.expiresAt);
+          const signInAgain = !kept;
+          if (signInAgain) deleteCookie(c, "session_token", { path: "/" });
+          return ok({
+            message: signInAgain ? "Other sign-ins ended. Sign in again in this browser." : "Other sign-ins ended.",
+            signInAgain,
+          });
+        } catch {
+          return fail({ code: "SIGN_OUT_OTHERS_FAILED", status: 500, message: "Signing out your other sign-ins did not work. Try again." });
+        }
       }),
   )
 

package/src/approvals/Approvals.tsx

@@ -1,12 +1,9 @@
 import { dates } from "@k2b/stdlib";
 import { Button, dialogCore, PanelDialog, Placeholder, panelDialogOptions, prompts, useLocale } from "@k2b/ui";
 import { createMemo, createSignal, For, type JSX, onCleanup, onMount, Show } from "solid-js";
-import { capabilityQuestionText, capabilityUnknownText } from "../_internal/capability-sentences";
-import { isLegacyActionReview, storedActionReview } from "../ai/action-review";
-import { type ActionCard, legacyActionCard, reviewActionCard } from "../ai/chat/action-card";
+import type { ActionCard } from "../ai/chat/action-card";
 import { actionMessages } from "../ai/chat/action-messages";
 import { ActionQuestion, ActionReceipt } from "../ai/chat/action-question";
-import { aiChatMessages } from "../ai/chat/messages";
 import { refreshAppBadges } from "../browser/app-badges";
 import { coreClient } from "../clients/core";
 import {
@@ -17,6 +14,7 @@ import {
   ApprovalPageSchema,
   type PendingApproval,
 } from "../contracts/approvals";
+import { approvalCard } from "./approval-card";
 import { approvalMessages } from "./messages";
 
 /** How a decided request ends in this list. It stays in place as a receipt until the next load. */
@@ -57,60 +55,13 @@ const useMessages = () => {
   return () => approvalMessages.resolve([locale()]).t;
 };
 
-const lines = (item: PendingApproval) =>
-  item.sentence
-    .split("\n")
-    .map((line) => line.trim())
-    .filter(Boolean);
-
-/** The first line names the app and the Action; the app already shows as the row's icon and origin. */
-const approvalTitle = (item: PendingApproval): string => {
-  const first = lines(item)[0] ?? item.action;
-  const prefix = `${item.app.name}: `;
-  return first.startsWith(prefix) && first.length > prefix.length ? first.slice(prefix.length) : first;
-};
-
-/** Without a review, the sentence's later `Label: value` lines are what the person approves. */
-const sentenceRows = (item: PendingApproval) =>
-  lines(item)
-    .slice(1)
-    .map((line) => {
-      const match = /^([^:]{1,40}):\s+(.+)$/.exec(line);
-      return match ? { label: match[1]!, value: match[2] ?? "" } : { label: "", value: line };
-    });
-
-/**
- * The same card as the chat: a new review gives the app's sentence, reason, and preview; an old review its literal
- * message and rows; a request without a review its sentence. Times show in the reader's zone (UTC until the page
- * passes one, the same on the server and in the first browser render).
- */
-const approvalCard = (item: PendingApproval, locale: string, timeZone: string): ActionCard => {
-  const app = { name: item.app.name, icon: item.app.icon ?? "ti ti-shield-check" };
-  const context = { locale, timeZone, app };
-  const review = item.review ? storedActionReview(item.review) : null;
-  if (review && !isLegacyActionReview(review)) return reviewActionCard(review, context);
-  const title = approvalTitle(item);
-  const t = aiChatMessages(locale);
-  return legacyActionCard(
-    {
-      question: review?.legacy.question ?? capabilityQuestionText(title, locale),
-      rows: review?.legacy.rows ?? sentenceRows(item),
-      ...(review?.legacy.markdown ? { markdown: review.legacy.markdown } : {}),
-      ...(review?.legacy.links ? { links: review.legacy.links } : {}),
-      subject: title,
-      title,
-      outcome: {
-        running: t.receiptRunning({ title }),
-        done: t.receiptDone({ title }),
-        rejected: t.receiptRejected({ title }),
-        notRun: t.receiptNotRun({ title, stopped: false }),
-        unknown: capabilityUnknownText(title, locale),
-        unknownStill: capabilityUnknownText(title, locale, true),
-      },
-    },
-    context,
-  );
-};
+const cardInput = (item: PendingApproval) => ({
+  sentence: item.sentence,
+  action: item.action,
+  appName: item.app.name,
+  appIcon: item.app.icon,
+  review: item.review,
+});
 
 /** Origin of the request: owning app, the chat it waits in, when Cloud asked, and when it expires. */
 function Origin(props: { item: PendingApproval; withApp?: boolean }) {
@@ -170,7 +121,7 @@ function ApprovalCard(props: {
 }) {
   const t = useMessages();
   const locale = useLocale();
-  const card = createMemo(() => approvalCard(props.item, locale(), READER_TIME_ZONE));
+  const card = createMemo(() => approvalCard(cardInput(props.item), locale(), READER_TIME_ZONE));
   const current = () => props.outcome ?? (props.failed ? "failed" : "sending");
   const state = () => (props.outcome || props.busy || props.failed ? "decided" : "open");
   // `confirm` asks every time, whatever the stored options say.
@@ -251,7 +202,7 @@ const openDetails = (item: PendingApproval, locale: string) =>
   dialogCore.open<ApprovalDecisionInput>(
     (close) => {
       const t = () => approvalMessages.resolve([locale]).t;
-      const card = approvalCard(item, locale, READER_TIME_ZONE);
+      const card = approvalCard(cardInput(item), locale, READER_TIME_ZONE);
       return (
         <PanelDialog>
           <PanelDialog.Header
@@ -290,7 +241,13 @@ const openDetails = (item: PendingApproval, locale: string) =>
         </PanelDialog>
       );
     },
-    { ...panelDialogOptions, history: true, ariaLabel: approvalMessages.resolve([locale]).t.approvalFor({ title: approvalTitle(item) }) },
+    {
+      ...panelDialogOptions,
+      history: true,
+      ariaLabel: approvalMessages
+        .resolve([locale])
+        .t.approvalFor({ title: approvalCard(cardInput(item), locale, READER_TIME_ZONE).questionText }),
+    },
   );
 
 function Row(props: {
@@ -304,6 +261,8 @@ function Row(props: {
 }) {
   const t = useMessages();
   const locale = useLocale();
+  // The band words the request as the card does: the plain question and Cloud's reason line.
+  const card = createMemo(() => approvalCard(cardInput(props.item), locale(), READER_TIME_ZONE));
   const details = async () => {
     const input = await openDetails(props.item, locale());
     if (input) props.decide(input);
@@ -322,10 +281,13 @@ function Row(props: {
         />
       }
     >
-      <article class="cloud-approval-band" data-decided={props.outcome} aria-label={t().approvalFor({ title: approvalTitle(props.item) })}>
+      <article class="cloud-approval-band" data-decided={props.outcome} aria-label={t().approvalFor({ title: card().questionText })}>
         <i class={props.outcome ? outcomeIcon(props.outcome, true) : "ti ti-alert-triangle"} aria-hidden="true" />
         <div class="cloud-approval-band__text">
-          <strong>{approvalTitle(props.item)}</strong>
+          <strong lang={card().locale}>{card().questionText}</strong>
+          <span class="cloud-approval-band__reason" lang={card().locale}>
+            {card().reason.text}
+          </span>
           <Origin item={props.item} withApp={false} />
         </div>
         <div class="cloud-approval__foot">