@nanobpm/nano-workforce 0.148.1 → 0.148.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## [0.148.2](https://github.com/nanobpm/nano-workforce/compare/v0.148.1...v0.148.2) (2026-08-27)
+
+### Bug Fixes
+
+* **delivery-graph:** in-DOM confirm for staged Dispatch/Dismiss/Save (App-View sandbox) ([#571](https://github.com/nanobpm/nano-workforce/issues/571)) ([6607399](https://github.com/nanobpm/nano-workforce/commit/6607399d0a172b878e50a05432091d8e97c7e224)), closes [#460](https://github.com/nanobpm/nano-workforce/issues/460) [#569](https://github.com/nanobpm/nano-workforce/issues/569)
+
 ## [0.148.1](https://github.com/nanobpm/nano-workforce/compare/v0.148.0...v0.148.1) (2026-08-26)
 
 ### Bug Fixes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.148.1",
+  "version": "0.148.2",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -71,6 +71,7 @@
     "@semantic-release/npm": "^13.1.5",
     "@types/node": "^24.0.0",
     "conventional-changelog-conventionalcommits": "^8.0.0",
+    "linkedom": "^0.18.13",
     "semantic-release": "^25.0.0",
     "typescript": "^5.6.0"
   },

package/pages/delivery-graphs/delivery-graphs.css

@@ -170,6 +170,42 @@
   color: #8aa0b8;
 }
 
+/* The inline in-DOM confirmation (issue #569): a two-step Dispatch/Dismiss "Confirm / Cancel" pair, or
+   an inline Save-to-library name input, rendered by staged.mount.js in place of the native
+   window.confirm/window.prompt the sandboxed console App-View iframe suppresses. It sits in the same
+   .actions row as the buttons it replaces. */
+.dg .confirm {
+  display: inline-flex;
+  align-items: center;
+  gap: 8px;
+  flex-wrap: wrap;
+}
+
+.dg .btn-danger {
+  background: #b5321f;
+  border-color: #d1442e;
+  color: #fff;
+}
+
+.dg .btn-danger:hover {
+  background: #d1442e;
+}
+
+.dg .confirm-msg {
+  color: #d7e0ea;
+  font-size: 13px;
+}
+
+.dg .confirm-input {
+  background: #0f1621;
+  color: #d7e0ea;
+  border: 1px solid #2b3a4e;
+  border-radius: 7px;
+  padding: 7px 12px;
+  font-size: 13px;
+  min-width: 200px;
+}
+
 /* The filesystem Import control (issue #524): a <label class="btn"> wrapping a visually-hidden native
    <input type=file>, so the file picker reads as a button consistent with the other actions. The label
    dims while its input is disabled (busy) via :has(), mirroring .btn:disabled. */

package/pages/delivery-graphs/staged.mount.js

@@ -54,6 +54,11 @@ const REQUEST_TIMEOUT_MS = 30000;
 
 // The confirm shown before a dispatch — dispatching authorises every side-effecting node, so the
 // operator acknowledges that the launch (and its side effects) is content-addressed to this graph.
+// This is rendered as an IN-DOM inline confirmation step (NOT a native window.confirm): the console
+// loads this view in a sandboxed App-View iframe with no `allow-modals`, where window.confirm is
+// silently suppressed (returns false) — so a native-modal gate reads as "operator declined" and the
+// button no-ops (#569). The two-step inline control keeps the #460 "the click IS the approval" UX
+// without depending on a host capability the App-View iframe doesn't grant.
 const DISPATCH_CONFIRM =
   "Dispatch this staged delivery graph? This launches the graph engine-natively — any side-effecting " +
   "node (it merges PRs / publishes packages) will run. Clicking Dispatch IS the approval, " +
@@ -61,7 +66,8 @@ const DISPATCH_CONFIRM =
 
 // The confirm shown before a dismiss — dismissing is a terminal discard: the proposal drops off the
 // staged list for good (it can be re-staged only by recompiling). It launches nothing, so this is a
-// lighter acknowledgement than Dispatch, but still a one-way action the operator confirms.
+// lighter acknowledgement than Dispatch, but still a one-way action the operator confirms. Rendered
+// as the same IN-DOM inline confirmation as Dispatch (no native window.confirm), for the #569 reason.
 const DISMISS_CONFIRM =
   "Dismiss this staged delivery graph? It is discarded as noise and drops off the staged list — this " +
   "launches nothing, but to bring it back you must recompile/re-stage it.";
@@ -81,8 +87,56 @@ function fmtTime(iso) {
   return esc(new Date(t).toLocaleString());
 }
 
-/** Render one staged proposal as a card row with Preview-DI + Dispatch actions. */
-function renderProposal(p) {
+// Is `pending` an open inline confirmation for `kind` on this proposal's row? `pending` is the single
+// open confirmation (or null) — see mountStagedProposals. Only the matching row+kind swaps its button
+// for the two-step inline control; every other row keeps its plain button.
+function isPending(pending, kind, digest) {
+  return pending != null && pending.kind === kind && pending.digest === digest;
+}
+
+// The Dispatch affordance for a row: normally a single button; while its inline confirmation is open,
+// an in-DOM "Confirm dispatch / Cancel" pair (NOT a native window.confirm, suppressed in the sandboxed
+// App-View iframe — #569). Clicking "Confirm dispatch" IS the operator approval (#460).
+function dispatchControl(p, pending) {
+  if (isPending(pending, "dispatch", p.digest)) {
+    return `<span class="confirm" data-confirm="dispatch">
+      <span class="confirm-msg">${esc(DISPATCH_CONFIRM)}</span>
+      <button class="btn btn-primary" type="button" data-dispatch-confirm="${esc(p.digest)}">Confirm dispatch</button>
+      <button class="btn btn-ghost" type="button" data-dispatch-cancel="${esc(p.digest)}">Cancel</button>
+    </span>`;
+  }
+  return `<button class="btn btn-primary" type="button" data-dispatch="${esc(p.digest)}">Dispatch</button>`;
+}
+
+// The Dismiss affordance: a plain button, or — while open — the in-DOM "Confirm dismiss / Cancel" pair.
+function dismissControl(p, pending) {
+  if (isPending(pending, "dismiss", p.digest)) {
+    return `<span class="confirm" data-confirm="dismiss">
+      <span class="confirm-msg">${esc(DISMISS_CONFIRM)}</span>
+      <button class="btn btn-danger" type="button" data-dismiss-confirm="${esc(p.digest)}">Confirm dismiss</button>
+      <button class="btn btn-ghost" type="button" data-dismiss-cancel="${esc(p.digest)}">Cancel</button>
+    </span>`;
+  }
+  return `<button class="btn btn-ghost" type="button" data-dismiss="${esc(p.digest)}">Dismiss</button>`;
+}
+
+// The Save-to-library affordance: a plain button, or — while open — an in-DOM text input for the entry
+// name plus Save/Cancel (replacing the native window.prompt, which returns null under sandbox — #569).
+function saveControl(p, pending) {
+  if (isPending(pending, "save", p.digest)) {
+    const name = typeof pending.name === "string" ? pending.name : "";
+    return `<span class="confirm" data-confirm="save">
+      <input class="confirm-input" type="text" data-library-name="${esc(p.digest)}" value="${esc(name)}" placeholder="Library entry name" aria-label="Library entry name" />
+      <button class="btn btn-primary" type="button" data-save-library-confirm="${esc(p.digest)}">Save</button>
+      <button class="btn btn-ghost" type="button" data-save-library-cancel="${esc(p.digest)}">Cancel</button>
+    </span>`;
+  }
+  return `<button class="btn btn-ghost" type="button" data-save-library="${esc(p.digest)}" data-title="${esc(p.title ?? "")}">Save to library</button>`;
+}
+
+/** Render one staged proposal as a card row with Preview-DI + Dispatch actions (and any open
+ *  in-DOM confirmation, keyed by `pending`). */
+function renderProposal(p, pending) {
   const title = p.title ? `<code>${esc(p.title)}</code>` : '<span class="muted">(unnamed)</span>';
   const gate = p.sideEffecting
     ? '<span class="pill pill-connector">side-effecting</span>'
@@ -99,15 +153,15 @@ function renderProposal(p) {
     </div>
     <div class="actions">
       <button class="btn btn-ghost" type="button" data-preview-di="${esc(p.digest)}">Preview generated DI</button>
-      <button class="btn btn-primary" type="button" data-dispatch="${esc(p.digest)}">Dispatch</button>
-      <button class="btn btn-ghost" type="button" data-save-library="${esc(p.digest)}" data-title="${esc(p.title ?? "")}">Save to library</button>
-      <button class="btn btn-ghost" type="button" data-dismiss="${esc(p.digest)}">Dismiss</button>
+      ${dispatchControl(p, pending)}
+      ${saveControl(p, pending)}
+      ${dismissControl(p, pending)}
     </div>
   </section>`;
 }
 
-/** Render the whole list (or the empty state). */
-function renderList(proposals) {
+/** Render the whole list (or the empty state), threading the single open in-DOM confirmation. */
+function renderList(proposals, pending) {
   if (!Array.isArray(proposals) || proposals.length === 0) {
     return `<section class="card">
       <h2>Staged proposals <span class="count">0</span></h2>
@@ -118,7 +172,7 @@ function renderList(proposals) {
     <h2>Staged proposals <span class="count">${proposals.length}</span></h2>
     <p class="ok">Awaiting an operator. <b>Preview generated DI</b> renders the laid-out BPMN in the process explorer; <b>Dispatch</b> launches it (dispatch is the approval, #460).</p>
   </section>`;
-  return header + proposals.map(renderProposal).join("");
+  return header + proposals.map((p) => renderProposal(p, pending)).join("");
 }
 
 // Only attach the guard secret when the resolved door URL is SAME-ORIGIN. The staged/dispatch/dismiss/
@@ -172,6 +226,14 @@ export function mountStagedProposals(host, config = {}) {
   }
 
   let busyCount = 0;
+  // The proposals from the last successful load — kept so an in-DOM confirmation opened/closed by a
+  // click can re-render the SAME list synchronously (without waiting for the next poll).
+  let currentProposals = [];
+  // The single open in-DOM confirmation, or null. Shape: { kind: "dispatch"|"dismiss"|"save",
+  // digest: string, name?: string }. This REPLACES the native window.confirm/window.prompt the console's
+  // sandboxed App-View iframe suppresses (#569): the operator approval is an inline two-step control
+  // (Confirm/Cancel) or an inline name input, rendered by renderProposal from this state.
+  let pending = null;
   // A re-render (renderList → new buttons) resets every button to enabled, so the disabled state is
   // NOT stored on the elements — it is derived from busyCount and re-applied after each render (below)
   // and on every busy()/idle() transition. That keeps a poll or dispatch-driven refresh from silently
@@ -184,6 +246,12 @@ export function mountStagedProposals(host, config = {}) {
     busyCount += on ? 1 : -1;
     applyDisabled();
   }
+  // Re-render the list from the last-known proposals, threading the open confirmation. Used by the
+  // click handlers that open/close an inline confirmation so it appears/disappears immediately.
+  function rerender() {
+    listEl.innerHTML = renderList(currentProposals, pending);
+    applyDisabled();
+  }
 
   /** Fetch JSON from a door and return { status, body } (never throws on an HTTP error). Rejects
    * (AbortError) if the request outlives REQUEST_TIMEOUT_MS so a hung door can't wedge the busy lock. */
@@ -217,14 +285,24 @@ export function mountStagedProposals(host, config = {}) {
       const { status, body } = await get(stagedUrl);
       if (disposed) return;
       if (status === 200 && Array.isArray(body.proposals)) {
-        listEl.innerHTML = renderList(body.proposals);
-        applyDisabled();
+        currentProposals = body.proposals;
+        // If the proposal an inline confirmation is open over has since dropped off the list (dispatched
+        // elsewhere, dismissed, or expired), the confirmation is stale — clear it so the poll can redraw.
+        if (pending != null && !body.proposals.some((p) => p.digest === pending.digest)) pending = null;
+        // While a confirmation (or its name input) is open, DON'T clobber the DOM the operator is
+        // interacting with — the fetch above still runs, so an expiry is detected and cleared above.
+        if (pending == null) {
+          listEl.innerHTML = renderList(body.proposals, pending);
+          applyDisabled();
+        }
         if (loadErrorShown) {
           setStatus("");
           loadErrorShown = false;
         }
       } else {
-        listEl.innerHTML = renderList([]);
+        currentProposals = [];
+        pending = null;
+        listEl.innerHTML = renderList([], pending);
         applyDisabled();
         setStatus(body && body.error ? body.error : "Could not load staged proposals.", "err");
         loadErrorShown = true;
@@ -270,15 +348,13 @@ export function mountStagedProposals(host, config = {}) {
     }
   }
 
-  // "Dispatch": the operator's launch (#460). Confirm (dispatch authorises every side-effecting node),
-  // then POST the digest to the dispatch door; on success the proposal flips to `dispatched` and drops
-  // off the list on the next poll — refresh immediately so the operator sees it leave.
+  // "Dispatch": the operator's launch (#460). The confirmation is an IN-DOM two-step control (opened by
+  // the click handler, #569) — by the time we're here the operator has clicked "Confirm dispatch", so we
+  // POST the digest to the dispatch door; on success the proposal flips to `dispatched` and drops off
+  // the list on the next poll — refresh immediately so the operator sees it leave.
   async function doDispatch(digest) {
     const staged = typeof digest === "string" ? digest.trim() : "";
     if (staged === "") return;
-    if (typeof window !== "undefined" && typeof window.confirm === "function" && !window.confirm(DISPATCH_CONFIRM)) {
-      return;
-    }
     busy(true);
     setStatus("Dispatching…");
     try {
@@ -296,15 +372,13 @@ export function mountStagedProposals(host, config = {}) {
     }
   }
 
-  // "Dismiss": the operator's discard (#520). Confirm (dismiss is a one-way drop off the staged list),
-  // then POST the digest to the dismiss door; on success the proposal flips to `dismissed` and drops off
-  // the list on the next poll — refresh immediately so the operator sees it leave. Launches nothing.
+  // "Dismiss": the operator's discard (#520). Confirmed via the same IN-DOM two-step control as Dispatch
+  // (#569); on the confirm we POST the digest to the dismiss door; on success the proposal flips to
+  // `dismissed` and drops off the list on the next poll — refresh immediately so the operator sees it
+  // leave. Launches nothing.
   async function doDismiss(digest) {
     const staged = typeof digest === "string" ? digest.trim() : "";
     if (staged === "") return;
-    if (typeof window !== "undefined" && typeof window.confirm === "function" && !window.confirm(DISMISS_CONFIRM)) {
-      return;
-    }
     busy(true);
     setStatus("Dismissing…");
     try {
@@ -323,20 +397,15 @@ export function mountStagedProposals(host, config = {}) {
   }
 
   // "Save to library": copy this staged proposal's already-stored graph into the reusable library
-  // (issue #523, save-from-digest → source `from-staged`). Prompt the operator for the entry name
-  // (defaulting to the proposal title — its slug/short-hash derive the library id, so re-saving the
-  // same name upserts), then POST { name, digest } to the save door. This persists a library entry
-  // only — it never dispatches or re-stages, so the operator boundary the staged view enforces (#460)
-  // is untouched.
-  async function doSaveToLibrary(digest, defaultName) {
+  // (issue #523, save-from-digest → source `from-staged`). The entry name comes from an IN-DOM inline
+  // text input (defaulting to the proposal title — its slug/short-hash derive the library id, so
+  // re-saving the same name upserts), NOT a native window.prompt (suppressed under the App-View sandbox,
+  // #569). We POST { name, digest } to the save door. This persists a library entry only — it never
+  // dispatches or re-stages, so the operator boundary the staged view enforces (#460) is untouched.
+  async function doSaveToLibrary(digest, rawName) {
     const staged = typeof digest === "string" ? digest.trim() : "";
     if (staged === "") return;
-    let name = defaultName ? String(defaultName) : "";
-    if (typeof window !== "undefined" && typeof window.prompt === "function") {
-      const entered = window.prompt("Save to library as (name):", name);
-      if (entered === null) return; // operator cancelled
-      name = entered;
-    }
+    const name = typeof rawName === "string" ? rawName : "";
     if (name.trim() === "") {
       setStatus("A library entry needs a non-blank name.", "err");
       return;
@@ -357,36 +426,132 @@ export function mountStagedProposals(host, config = {}) {
     }
   }
 
+  // Open an inline confirmation for `kind` on `digest` (Dispatch/Dismiss) or the inline name input
+  // (Save) — replacing the native modal the sandboxed App-View iframe suppresses (#569).
+  function openConfirm(kind, digest, name) {
+    const staged = typeof digest === "string" ? digest.trim() : "";
+    if (staged === "") return;
+    pending = { kind, digest: staged, name: typeof name === "string" ? name : "" };
+    rerender();
+    // Move focus into the name input so the operator can type immediately (best-effort; not all hosts
+    // implement focus()).
+    if (kind === "save") {
+      const input = listEl.querySelector(`[data-library-name="${cssAttr(staged)}"]`);
+      if (input && typeof input.focus === "function") input.focus();
+    }
+  }
+
+  // Close any open inline confirmation and redraw the plain buttons.
+  function closeConfirm() {
+    pending = null;
+    rerender();
+  }
+
+  // The digest values are content-address hex (safe for a CSS attribute-selector), but escape a double
+  // quote defensively so a crafted value can't break out of the [data-library-name="…"] selector.
+  function cssAttr(value) {
+    return String(value).replace(/["\\]/g, "\\$&");
+  }
+
+  // Read the current text of the inline library-name input for `digest` (empty string if it's gone).
+  function readLibraryName(digest) {
+    const input = listEl.querySelector(`[data-library-name="${cssAttr(digest)}"]`);
+    return input && typeof input.value === "string" ? input.value : "";
+  }
+
+  // Keep pending.name in sync as the operator types, so a background poll re-render (or a later confirm)
+  // preserves what they've entered.
+  listEl.addEventListener("input", (ev) => {
+    const input = ev.target && ev.target.closest ? ev.target.closest("[data-library-name]") : null;
+    if (input && pending != null && pending.kind === "save") {
+      pending.name = typeof input.value === "string" ? input.value : "";
+    }
+  });
+
   listEl.addEventListener("click", (ev) => {
-    const previewBtn = ev.target && ev.target.closest ? ev.target.closest("[data-preview-di]") : null;
+    const closest = (sel) => (ev.target && ev.target.closest ? ev.target.closest(sel) : null);
+
+    const previewBtn = closest("[data-preview-di]");
     if (previewBtn) {
       ev.preventDefault();
       doPreviewDi(previewBtn.getAttribute("data-preview-di"));
       return;
     }
-    const dispatchBtn = ev.target && ev.target.closest ? ev.target.closest("[data-dispatch]") : null;
+
+    // Dispatch: click opens the inline confirmation; "Confirm dispatch" performs the POST; "Cancel"
+    // closes it. The click IS the approval (#460), now gated on an in-DOM step, not window.confirm (#569).
+    const dispatchBtn = closest("[data-dispatch]");
     if (dispatchBtn) {
       ev.preventDefault();
-      doDispatch(dispatchBtn.getAttribute("data-dispatch"));
+      openConfirm("dispatch", dispatchBtn.getAttribute("data-dispatch"));
       return;
     }
-    const saveLibraryBtn = ev.target && ev.target.closest ? ev.target.closest("[data-save-library]") : null;
-    if (saveLibraryBtn) {
+    const dispatchConfirmBtn = closest("[data-dispatch-confirm]");
+    if (dispatchConfirmBtn) {
       ev.preventDefault();
-      doSaveToLibrary(saveLibraryBtn.getAttribute("data-save-library"), saveLibraryBtn.getAttribute("data-title"));
+      const digest = dispatchConfirmBtn.getAttribute("data-dispatch-confirm");
+      closeConfirm();
+      doDispatch(digest);
       return;
     }
-    const dismissBtn = ev.target && ev.target.closest ? ev.target.closest("[data-dismiss]") : null;
+    const dispatchCancelBtn = closest("[data-dispatch-cancel]");
+    if (dispatchCancelBtn) {
+      ev.preventDefault();
+      closeConfirm();
+      return;
+    }
+
+    // Dismiss: same two-step inline confirmation.
+    const dismissBtn = closest("[data-dismiss]");
     if (dismissBtn) {
       ev.preventDefault();
-      doDismiss(dismissBtn.getAttribute("data-dismiss"));
+      openConfirm("dismiss", dismissBtn.getAttribute("data-dismiss"));
+      return;
+    }
+    const dismissConfirmBtn = closest("[data-dismiss-confirm]");
+    if (dismissConfirmBtn) {
+      ev.preventDefault();
+      const digest = dismissConfirmBtn.getAttribute("data-dismiss-confirm");
+      closeConfirm();
+      doDismiss(digest);
+      return;
+    }
+    const dismissCancelBtn = closest("[data-dismiss-cancel]");
+    if (dismissCancelBtn) {
+      ev.preventDefault();
+      closeConfirm();
+      return;
+    }
+
+    // Save to library: the button opens an inline name input; "Save" reads it and POSTs; "Cancel" closes.
+    const saveLibraryBtn = closest("[data-save-library]");
+    if (saveLibraryBtn) {
+      ev.preventDefault();
+      openConfirm("save", saveLibraryBtn.getAttribute("data-save-library"), saveLibraryBtn.getAttribute("data-title"));
+      return;
+    }
+    const saveConfirmBtn = closest("[data-save-library-confirm]");
+    if (saveConfirmBtn) {
+      ev.preventDefault();
+      const digest = saveConfirmBtn.getAttribute("data-save-library-confirm");
+      const name = readLibraryName(digest);
+      closeConfirm();
+      doSaveToLibrary(digest, name);
+      return;
+    }
+    const saveCancelBtn = closest("[data-save-library-cancel]");
+    if (saveCancelBtn) {
+      ev.preventDefault();
+      closeConfirm();
     }
   });
 
   refresh();
   // Skip a scheduled poll while a Preview/Dispatch request is in flight: re-rendering the list mid-
   // request would drop the in-flight button (and its disabled state) out from under the user. The
-  // dispatch path drives its own refresh() on completion, so nothing is missed.
+  // dispatch path drives its own refresh() on completion, so nothing is missed. While an inline
+  // confirmation is open the poll still fetches (so an expiry is detected) but refresh() leaves the DOM
+  // the operator is interacting with untouched (see refresh).
   const timer = setInterval(() => {
     if (busyCount === 0) refresh();
   }, refreshMs);

package/test/delivery-graphs-staged-confirm.test.ts

@@ -0,0 +1,192 @@
+// Behavioural guard for the Staged proposals App-View confirmation path (issue #569).
+//
+// The console loads this view inside a SANDBOXED App-View iframe with no `allow-modals`, where the
+// browser SILENTLY SUPPRESSES window.confirm/window.prompt — the call returns false/null. The old mount
+// gated Dispatch/Dismiss on `!window.confirm(...)` and Save-to-library on `window.prompt(...) === null`,
+// so under the sandbox the suppressed false/null read as "operator declined/cancelled" and the button
+// silently no-op'd: no POST, no banner (#569). This test drives the REAL mount over a real (linkedom)
+// DOM with window.confirm/window.prompt STUBBED TO THE SANDBOX BEHAVIOUR (false/null), and asserts the
+// side-effecting POST still fires — because the approval is now an IN-DOM two-step control, not a native
+// modal. It fails against the pre-fix mount (no in-DOM Confirm affordance ever appears, no POST).
+import { test } from "node:test";
+import { assert, assertEquals } from "#test-assert";
+import { parseHTML } from "linkedom";
+import { mountStagedProposals } from "../pages/delivery-graphs/staged.mount.js";
+
+const STAGED_URL = "https://app.test/app/api/delivery-graph/staged";
+const DISPATCH_URL = "https://app.test/app/api/actions/delivery-graph/dispatch";
+const DISMISS_URL = "https://app.test/app/api/actions/delivery-graph/dismiss";
+const SAVE_URL = "https://app.test/app/api/actions/delivery-graph/library/save";
+
+const PROPOSAL = {
+  digest: "abc123def456",
+  title: "My delivery graph",
+  sideEffecting: true,
+  nodeCount: 3,
+  humanNodeCount: 1,
+  sideEffectCount: 1,
+  createdAt: "2026-01-01T00:00:00.000Z",
+  expiresAt: "2026-01-02T00:00:00.000Z",
+};
+
+interface FetchCall {
+  url: string;
+  method: string;
+  body: string;
+}
+
+/** Boot the real mount over a linkedom DOM whose `window` mimics a sandboxed App-View iframe (native
+ *  confirm/prompt SUPPRESSED → false/null), with a recording fetch double. */
+function harness() {
+  const { window: domWindow, document } = parseHTML(
+    "<!doctype html><html><body><div id='host'></div></body></html>",
+  );
+  const host = document.getElementById("host");
+  assert(host, "harness host element must exist");
+
+  const calls: FetchCall[] = [];
+  const origFetch = globalThis.fetch;
+  globalThis.fetch = async (input, init) => {
+    const url = String(input);
+    const method = init && typeof init.method === "string" ? init.method : "GET";
+    const body = init && typeof init.body === "string" ? init.body : "";
+    calls.push({ url, method, body });
+    if (method === "GET" && url === STAGED_URL) {
+      return new Response(JSON.stringify({ proposals: [PROPOSAL] }), { status: 200 });
+    }
+    if (url === DISPATCH_URL) return new Response(JSON.stringify({ ok: true }), { status: 202 });
+    if (url === DISMISS_URL) return new Response(JSON.stringify({ ok: true }), { status: 200 });
+    if (url === SAVE_URL) return new Response(JSON.stringify({ ok: true }), { status: 200 });
+    return new Response(JSON.stringify({}), { status: 404 });
+  };
+
+  // A sandboxed iframe with no `allow-modals`: confirm() returns false, prompt() returns null. If the
+  // mount depended on either, the action would silently no-op — which is exactly the #569 bug.
+  const sandboxWindow = {
+    confirm: () => false,
+    prompt: () => null,
+    location: { href: "https://app.test/delivery-graphs/", origin: "https://app.test" },
+    parent: undefined as unknown,
+  };
+  sandboxWindow.parent = sandboxWindow; // parent === window ⇒ not embedded (no host explorer to drive)
+  const origWindow = Reflect.get(globalThis, "window");
+  Reflect.set(globalThis, "window", sandboxWindow);
+
+  const dispose = mountStagedProposals(host, {
+    stagedUrl: STAGED_URL,
+    dispatchUrl: DISPATCH_URL,
+    dismissUrl: DISMISS_URL,
+    saveLibraryUrl: SAVE_URL,
+    refreshMs: 1_000_000_000, // effectively no background poll during the test
+  });
+
+  const teardown = () => {
+    dispose();
+    globalThis.fetch = origFetch;
+    Reflect.set(globalThis, "window", origWindow);
+  };
+
+  const flush = async () => {
+    for (let i = 0; i < 4; i++) await new Promise((resolve) => setTimeout(resolve, 0));
+  };
+  const click = (el: { dispatchEvent: (ev: unknown) => boolean }) =>
+    el.dispatchEvent(new domWindow.Event("click", { bubbles: true, cancelable: true }));
+
+  return { host, calls, teardown, flush, click };
+}
+
+const posts = (calls: FetchCall[], url: string) => calls.filter((c) => c.method === "POST" && c.url === url);
+
+test("#569: Dispatch dispatches via the in-DOM confirmation even when native window.confirm is suppressed", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    const dispatchBtn = h.host.querySelector("[data-dispatch]");
+    assert(dispatchBtn, "the mount must render a Dispatch button for the staged proposal");
+
+    // Click Dispatch — with a suppressed native confirm, the PRE-FIX mount POSTs nothing; the fixed
+    // mount instead reveals an in-DOM "Confirm dispatch" step and has NOT yet POSTed.
+    h.click(dispatchBtn);
+    await h.flush();
+    assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "Dispatch must not POST before the operator confirms in-DOM");
+    const confirmBtn = h.host.querySelector("[data-dispatch-confirm]");
+    assert(confirmBtn, "clicking Dispatch must reveal an in-DOM Confirm-dispatch control (#569), not call window.confirm");
+    assert(!h.host.querySelector("[data-dispatch]"), "the plain Dispatch button is replaced by the inline confirmation while it is open");
+
+    // Confirm — the digest is POSTed to the dispatch door, with no reliance on a native modal.
+    h.click(confirmBtn);
+    await h.flush();
+    const dispatched = posts(h.calls, DISPATCH_URL);
+    assertEquals(dispatched.length, 1, "confirming in-DOM must POST exactly once to the dispatch door");
+    assertEquals(JSON.parse(dispatched[0].body), { digest: PROPOSAL.digest }, "the dispatch POST carries the staged digest");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#569: Cancel on the in-DOM Dispatch confirmation aborts without POSTing", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    h.click(h.host.querySelector("[data-dispatch]"));
+    await h.flush();
+    const cancelBtn = h.host.querySelector("[data-dispatch-cancel]");
+    assert(cancelBtn, "the in-DOM Dispatch confirmation must offer a Cancel affordance");
+    h.click(cancelBtn);
+    await h.flush();
+    assertEquals(posts(h.calls, DISPATCH_URL).length, 0, "cancelling must not POST to the dispatch door");
+    assert(h.host.querySelector("[data-dispatch]"), "cancelling restores the plain Dispatch button");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#569: Dismiss discards via the in-DOM confirmation even when native window.confirm is suppressed", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    const dismissBtn = h.host.querySelector("[data-dismiss]");
+    assert(dismissBtn, "the mount must render a Dismiss button for the staged proposal");
+    h.click(dismissBtn);
+    await h.flush();
+    assertEquals(posts(h.calls, DISMISS_URL).length, 0, "Dismiss must not POST before the operator confirms in-DOM");
+    const confirmBtn = h.host.querySelector("[data-dismiss-confirm]");
+    assert(confirmBtn, "clicking Dismiss must reveal an in-DOM Confirm-dismiss control (#569)");
+    h.click(confirmBtn);
+    await h.flush();
+    const dismissed = posts(h.calls, DISMISS_URL);
+    assertEquals(dismissed.length, 1, "confirming in-DOM must POST exactly once to the dismiss door");
+    assertEquals(JSON.parse(dismissed[0].body), { digest: PROPOSAL.digest }, "the dismiss POST carries the staged digest");
+  } finally {
+    h.teardown();
+  }
+});
+
+test("#569: Save-to-library names the entry via an in-DOM input even when native window.prompt is suppressed", async () => {
+  const h = harness();
+  try {
+    await h.flush();
+    const saveBtn = h.host.querySelector("[data-save-library]");
+    assert(saveBtn, "the mount must render a Save-to-library button for the staged proposal");
+    h.click(saveBtn);
+    await h.flush();
+    assertEquals(posts(h.calls, SAVE_URL).length, 0, "Save must not POST before the operator enters a name and confirms in-DOM");
+    const nameInput = h.host.querySelector("[data-library-name]");
+    assert(nameInput, "clicking Save-to-library must reveal an in-DOM name input (#569), not call window.prompt");
+    nameInput.value = "Reusable graph";
+
+    const saveConfirmBtn = h.host.querySelector("[data-save-library-confirm]");
+    assert(saveConfirmBtn, "the in-DOM Save-to-library control must offer a Save affordance");
+    h.click(saveConfirmBtn);
+    await h.flush();
+    const saved = posts(h.calls, SAVE_URL);
+    assertEquals(saved.length, 1, "confirming in-DOM must POST exactly once to the save-to-library door");
+    assertEquals(
+      JSON.parse(saved[0].body),
+      { name: "Reusable graph", digest: PROPOSAL.digest },
+      "the save POST carries the in-DOM-entered name and the staged digest",
+    );
+  } finally {
+    h.teardown();
+  }
+});

package/test/delivery-graphs-staged-embed.test.ts

@@ -110,10 +110,15 @@ test("#511: DI preview — the staged view wires the proposal-bpmn door and brid
   assert(/params:\s*\{\s*xml:/.test(MOUNT_JS), "staged.mount.js must carry the compiled BPMN xml in the bridge message");
 });
 
-test("#460/#511: Dispatch is the operator's launch — posts the digest to the dispatch door, and never compiles/stages", () => {
+test("#460/#511/#569: Dispatch is the operator's launch — posts the digest to the dispatch door, and never compiles/stages", () => {
   assertModuleAnchored("dispatchUrl", "app/api/actions/delivery-graph/dispatch");
   assert(/data-dispatch=/.test(MOUNT_JS), "staged.mount.js must render a per-row Dispatch affordance carrying the digest");
-  assert(/window\.confirm\(/.test(MOUNT_JS), "Dispatch must confirm before launching (dispatch authorises side effects)");
+  // #569: the confirmation must be IN-DOM (a two-step "Confirm dispatch" affordance), NOT a native
+  // window.confirm — the sandboxed console App-View iframe (no allow-modals) suppresses window.confirm
+  // (returns false), so a native-modal gate reads as "operator declined" and the button silently no-ops.
+  assert(/data-dispatch-confirm=/.test(MOUNT_JS), "Dispatch must confirm via an in-DOM two-step control (data-dispatch-confirm), not window.confirm (#569)");
+  assert(!/window\.confirm\(/.test(MOUNT_JS), "Dispatch must NOT gate on native window.confirm — it is suppressed in the sandboxed App-View iframe (#569)");
+  assert(!/window\.prompt\(/.test(MOUNT_JS), "the staged view must NOT gate on native window.prompt — it is suppressed in the sandboxed App-View iframe (#569)");
   // Operator-only: this surface dispatches a digest that is ALREADY staged — it must not compile or
   // stage (that is the compose view), so the #460 boundary holds and the self-approval hole stays shut.
   assert(!/delivery-graph\/preview\b/.test(MOUNT_JS), "staged.mount.js must NOT wire the compile/stage door");
@@ -121,9 +126,19 @@ test("#460/#511: Dispatch is the operator's launch — posts the digest to the d
   assert(!/approvalToken/.test(MOUNT_JS), "staged.mount.js must NOT carry the removed replayable approvalToken");
 });
 
-test("#520: Dismiss is the operator's discard — posts the digest to the dismiss door, behind a confirm, and launches nothing", () => {
+test("#520/#569: Dismiss is the operator's discard — posts the digest to the dismiss door, behind an in-DOM confirm, and launches nothing", () => {
   assertModuleAnchored("dismissUrl", "app/api/actions/delivery-graph/dismiss");
   assert(/data-dismiss=/.test(MOUNT_JS), "staged.mount.js must render a per-row Dismiss affordance carrying the digest");
-  // Dismiss is a one-way discard off the staged list — confirm before it drops the proposal.
-  assert(/window\.confirm\(DISMISS_CONFIRM\)/.test(MOUNT_JS), "staged.mount.js must confirm before dismissing (a one-way discard off the staged list)");
+  // Dismiss is a one-way discard off the staged list — confirm before it drops the proposal, via the
+  // same in-DOM two-step control as Dispatch (#569), not a native window.confirm.
+  assert(/data-dismiss-confirm=/.test(MOUNT_JS), "staged.mount.js must confirm before dismissing via an in-DOM control (data-dismiss-confirm), not window.confirm (#569)");
+});
+
+test("#523/#569: Save-to-library names the entry via an in-DOM input, not a native window.prompt", () => {
+  assertModuleAnchored("saveLibraryUrl", "app/api/actions/delivery-graph/library/save");
+  assert(/data-save-library=/.test(MOUNT_JS), "staged.mount.js must render a per-row Save-to-library affordance carrying the digest");
+  // #569: the library name must come from an in-DOM text input; window.prompt returns null under the
+  // App-View sandbox, which the old code read as "operator cancelled" → silent no-op.
+  assert(/data-library-name=/.test(MOUNT_JS), "staged.mount.js must collect the library name via an in-DOM input (data-library-name), not window.prompt (#569)");
+  assert(/data-save-library-confirm=/.test(MOUNT_JS), "staged.mount.js must confirm the save via an in-DOM Save affordance (data-save-library-confirm)");
 });