@nauticana/sail 1.1.32 → 1.1.34

package/README.md

@@ -2,7 +2,7 @@
 
 A shared Angular component library for building CRUD-based admin frontends. Provides table management, form handling, navigation, authentication, two-factor authentication, and trusted device management — all driven by metadata from a [keel](https://github.com/nauticana/keel) Go backend.
 
-> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.32 adopts keel v1.2.101 (the OAuth connect callback ticket), sail v1.1.31 adopts keel v1.2.100 (tenant single sign-on, DNS and HTTP-file domain verification), sail v1.1.30 adopts keel v1.2.99 (password routes; a password change signs out), sail v1.1.29 adopts keel v1.2.94 (signup: confirmation signs in, partner setup, sign-in hand-off code), sail v1.1.28 adopts keel v1.2.93 (absolute `return` for the OAuth hand-off), sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
+> **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x**; sail v1.1.33 adopts keel v1.2.106 (`prompt` on the login page, new-device step-up, sign-in sessions), sail v1.1.32 adopts keel v1.2.101 (the OAuth connect callback ticket), sail v1.1.31 adopts keel v1.2.100 (tenant single sign-on, DNS and HTTP-file domain verification), sail v1.1.30 adopts keel v1.2.99 (password routes; a password change signs out), sail v1.1.29 adopts keel v1.2.94 (signup: confirmation signs in, partner setup, sign-in hand-off code), sail v1.1.28 adopts keel v1.2.93 (absolute `return` for the OAuth hand-off), sail v1.1.18 adopts keel v1.2.58 (refresh-token rotation, `/public/logout`, setup intents, the realtime hub), the agency components in sail v1.1.14 require keel v1.2.41 (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
 
 **Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows. `passwordPolicyValidator` + `BaseAuthService.ensurePasswordPolicy()` — validate passwords against keel's policy (via `SailGuiConfig.passwordPolicyUrl`); see Configuration reference.
 
@@ -16,7 +16,7 @@ A shared Angular component library for building CRUD-based admin frontends. Prov
 | **Form components** | `DynamicField`, `RecordForm`, `TableForm` |
 | **Navigation** | `Navigation` (sidenav + toolbar with menu, responsive) |
 | **Login** | `LoginComponent`, `RegisterComponent`, `ChpassComponent`, `ConfirmRegisterComponent`, `ConfirmChpassComponent` |
-| **Security** | `TwoFactorSetupComponent`, `TwoFactorVerifyComponent`, `TrustedDevicesComponent`, `AccountDeletionComponent` |
+| **Security** | `TwoFactorSetupComponent`, `TwoFactorVerifyComponent`, `TrustedDevicesComponent`, `SessionsComponent`, `AccountDeletionComponent` |
 | **Account** | `MyAccountComponent` (self-service hub), `ProfileEditorComponent` (name/locale immediate; email/phone verify-before-apply) |
 | **Auth** | `ConsentGateComponent`, `OtpInputComponent`, `SocialLoginComponent`, `SsoLoginComponent`, `SsoReturnComponent` |
 | **Billing** | `PlanSelectorComponent`, `PriceSelectorComponent`, `CheckoutButtonComponent`, `PaymentMethodsComponent`, `PortalButtonComponent`, `UsageMeterComponent`, `StatusChipComponent`, `TrialBannerComponent`, `SeatSelectorComponent`, `DunningBannerComponent` |
@@ -221,7 +221,7 @@ Key CSS classes used by components:
 
 /* Security */
 .twofactor-qr, .twofactor-backup, .backup-code-list,
-.trusted-devices-table
+.trusted-devices-table, .sessions-table
 ```
 
 ## How it works
@@ -264,7 +264,7 @@ Default page size is 100, capped at 1000 server-side. Sail maps `limit`, `offset
 
 ## Backend-driven constant captions
 
-`LabelService` loads one keel `constant_value` domain from the backend-provided `ApplicationData.ConstantCache` and caches its value-to-caption map. The domain is the backend `constant_id` (for example `ride_type`), not a locale: keel's constant catalogue does not contain a language column. It does not call generic `constant_value` CRUD, which is normally restricted to administrative roles.
+`LabelService` loads one caption map from the backend-provided `ApplicationData`: a keel `constant_value` domain from `ConstantCache` by constant id, or a catalog table registered in `foreign_key_lookup` from `TableCache` by table name. `sailCaption` is the pipe form: `{{ code | sailCaption:'constant_id' }}`. The domain is the backend `constant_id` (for example `ride_type`), not a locale: keel's constant catalogue does not contain a language column. It does not call generic `constant_value` CRUD, which is normally restricted to administrative roles.
 
 ```typescript
 this.labels.loadLabels('ride_type').subscribe(() => {
@@ -331,6 +331,11 @@ origin, is not followed. Failures set `BaseAuthService.sessionHandoffError` (ren
 `<sail-login>`) and never redirect: 400 means keel rejected the return URL, 401 means the user
 signs in again to retry. The authorization server must allow the SPA origin by CORS.
 
+With `prompt=login` or `prompt=select_account`, `<sail-login>` holds back the stored session and
+offers sign-out (`isLoggedIn` stays false); account selection also offers `continueSession()`. A
+fresh sign-in, including its 2FA step, keeps the hand-off query. Any sign-in revokes the refresh
+token it replaces.
+
 Set `passwordPolicyUrl` to the app's public route for keel's `PublicHandler.GetPasswordPolicy`
 (e.g. `'/public/v1/auth/password/policy'`). `BaseAuthService.ensurePasswordPolicy()` fetches it
 once into the `passwordRules` signal, and `passwordPolicyValidator(() => auth.passwordRules())`
@@ -348,7 +353,7 @@ Omit the URL to skip client-side policy checks. The server stays the authoritati
 | `POST /public/otp/send` | Send OTP code to phone or email; returns opaque `otpToken` |
 | `POST /public/otp/verify` | Verify OTP code with `otpToken`, returns JWT |
 | `POST /public/otp/resend` | Re-issue OTP for an existing `otpToken` |
-| `POST /public/2fa/verify` | Login-time TOTP verification (uses `loginToken`) |
+| `POST /public/2fa/verify` | Login-time TOTP or emailed step-up code verification (uses `loginToken`) |
 | `POST /public/2fa/backup-verify` | Login-time backup-code verification |
 | `POST /public/register` | Start a signup from a `PartnerRegistration`; emails the confirmation code |
 | `POST /public/register/confirm` | Confirm `?email=&code=`; answers session tokens and the partner result (`confirmRegister`) |
@@ -367,6 +372,8 @@ Omit the URL to skip client-side policy checks. The server stays the authoritati
 | `POST /api/user/2fa/disable` | Disable 2FA — **requires password + current TOTP code** |
 | `GET /api/user/trusted-device/list` | List trusted devices |
 | `POST /api/user/trusted-device/revoke` | Revoke a trusted device |
+| `GET /api/user/sessions` | The caller's live sign-in sessions (`getSessions`) |
+| `POST /api/user/sessions/revoke` | Sign out one session `{id}` (`revokeSession`); 404 `session_not_found` |
 | `POST /api/user/logout-everywhere` | Sign out of all devices — **requires re-auth** |
 | `DELETE /api/user/account` | Soft-delete the caller's account — **requires re-auth** |
 | `GET /api/notifications` | Notification inbox page — `?before=<id>&limit=<n>`, newest first (keel v1.2.71) |
@@ -382,13 +389,13 @@ Omit the URL to skip client-side policy checks. The server stays the authoritati
 | `GET /api/billing/invoices` | Invoice history |
 | `GET /api/billing/payment-methods` | Saved payment methods |
 
-Device registration happens within `/public/2fa/verify` when `trustDevice=true`. Since **keel v0.9 / sail v0.9.0**, the trusted-device credential is a server-minted `keel_td` cookie (HttpOnly + Secure + SameSite=Strict) — not a client-supplied fingerprint. sail sets `withCredentials: true` on the login and 2FA-verify calls so the cookie round-trips; see [Enabling 2FA → Cross-origin cookie requirement](#cross-origin-cookie-requirement) below.
+Device registration happens within `/public/2fa/verify` when `trustDevice=true`. Since **keel v0.9 / sail v0.9.0**, the trusted-device credential is a server-minted `keel_td` cookie (HttpOnly + Secure + SameSite=Strict) — not a client-supplied fingerprint. sail sets `withCredentials: true` on every session-minting call (password, Google, social, OTP, 2FA and backup verify, registration confirm and exchange) so this cookie and keel's `keel_device` cookie (keel v1.2.106: a recognized device gets no new-device notice or step-up) round-trip; see [Enabling 2FA → Cross-origin cookie requirement](#cross-origin-cookie-requirement) below.
 
 ## Enabling 2FA in your project
 
 Add the 2FA verification route to your `publicRoutes` config:
 ```typescript
-import { TwoFactorVerifyComponent, TwoFactorSetupComponent, TrustedDevicesComponent } from '@nauticana/sail';
+import { SessionsComponent, TrustedDevicesComponent, TwoFactorSetupComponent, TwoFactorVerifyComponent } from '@nauticana/sail';
 
 // In publicRoutes:
 { path: 'login/2fa', component: TwoFactorVerifyComponent }
@@ -396,9 +403,12 @@ import { TwoFactorVerifyComponent, TwoFactorSetupComponent, TrustedDevicesCompon
 // In extraRoutes or authenticated routes (optional — for user self-service):
 { path: 'security/2fa', component: TwoFactorSetupComponent }
 { path: 'security/devices', component: TrustedDevicesComponent }
+{ path: 'security/sessions', component: SessionsComponent }
 ```
 
-The login flow handles 2FA automatically: when the backend returns `twoFactorRequired: true`, sail redirects to `/login/2fa`. No other code changes needed.
+The login flow redirects `twoFactorRequired` responses to `/login/2fa`. With `twoFactorMethod: 'email'`, the page explains the new-device check and hides device trust and backup codes. Sign-in refusals `signin_network` and `stepup_unavailable` have user-facing messages.
+
+`SessionsComponent` (`<sail-sessions>`) lists the sessions with their `sign_in_method` captions, marks the current one, and signs out any other.
 
 ### Cross-origin cookie requirement
 
@@ -407,7 +417,7 @@ The "trust this device" feature (keel v0.9+) is backed by a server-set HttpOnly
 1. On `POST /public/2fa/verify` with `trustDevice: true`, keel mints a 32-byte secret, stores its SHA-256, and returns the raw secret to the browser **only** as a `Set-Cookie: keel_td=…` header (never in the JSON body).
 2. On the next `POST /public/login/local` (or `/public/login/gmail`), the browser sends the `keel_td` cookie back, keel hashes it, finds the matching row, and **skips the 2FA prompt**.
 
-For the browser to store and resend that cookie, the requests must be credentialed. sail already sets `withCredentials: true` on `login()`, `loginWithGoogle()`, `verify2FALogin()`, and `verifyBackupCode()` — **you do not add this in your app code**. But the keel backend must permit credentialed CORS, or the browser drops the cookie and every login re-prompts for 2FA:
+For the browser to store and resend that cookie, the requests must be credentialed. sail already sets `withCredentials: true` on these calls — **you do not add this in your app code**. But the keel backend must permit credentialed CORS, or the browser drops the cookie and every login re-prompts for 2FA:
 
 - **Same-origin** deployments (SPA served from the same host as the API) work with no extra config — credentialed same-origin requests are always allowed.
 - **Cross-origin** deployments (SPA on a different host/port than the API) require the keel `HttpBackend` to set:
@@ -674,7 +684,7 @@ A complete screen is the pieces above assembled over `BillingService` — no met
 
 ## Agent UI (v1.1.20)
 
-Agent Studio and agent-conversation UI live in a secondary entry point, `@nauticana/sail/agent`. Nothing in it is exported from `@nauticana/sail`, so an app that never imports it bundles none of it. It needs no additional peer dependency.
+Agent Studio and agent-conversation UI live in a secondary entry point, `@nauticana/sail/agent`. Nothing in it is exported from `@nauticana/sail`, so an app that never imports it bundles none of it. It needs no additional peer dependency. The wire types match Scout v1.2.8.
 
 ```ts
 import { AgentStudioService, PromptLanguageEditorComponent, TurnStream } from '@nauticana/sail/agent';
@@ -682,7 +692,10 @@ import { AgentStudioService, PromptLanguageEditorComponent, TurnStream } from '@
 
 | Export | Purpose |
 |---|---|
-| `AgentStudioService` | Client for the thirteen `studio-v2` routes under `/api/agent-studio/` (fixed, unversioned paths). Models mirror the backend's JSON names. |
+| `AgentStudioService` | Client for Scout's core Studio routes under `/api/agent-studio/` (fixed, unversioned paths): the `features` manifest, list, draft, settings, create, rename, archive, enable, test, publish, restore, reset, default, history, audit, release sections, models. Models mirror the backend's JSON names. |
+| `sail-studio-page` | Embeddable Studio: an agent rail grouped by `[groupBy]` (agent type by default; pass a function for workflow or position), and Overview, Prompts, Settings (scoped bindings and what they resolve to), Test, and History (diff, restore, audit) tabs. Product tabs are `<ng-template sailStudioTab="id" label="Label" let-agent>`. A control shows only when the `agents` feature lists its action and the caller holds the `AGENT_STUDIO` grant at `agent:<name>` (`agent_type:<type>` for create); hiding is never the authorization. `hasUnsavedChanges()` serves a `canDeactivate` guard. |
+| `sail-approval-inbox` / `ApprovalService` | The signed-in person's pending approvals (`GET /api/approval/pending`) and a decision view: approve, reject, or edit a tool call's arguments (`POST /api/approval/resolve`). A `409` reloads the list; `(decided)` emits the result. |
+| `studioErrorMessage(err)` | One message for a failed Studio call: the conflict cause, the field errors, or the detail. |
 | `studioConflictCause(err)` | `'revision'` (reload the draft), `'sealed'` (a layer sits under a sealed one) or `'other'` for a `409`. |
 | `studioFieldErrors(err)` / `retryAfterSeconds(err)` | Field errors of a `400`; `Retry-After` of a `429`/`503`. |
 | `sail-prompt-language-editor` | One language's prompt sections. Emits the whole language on every edit — a save must send every layer back, because an editable layer missing from the request ends its binding. Emits `resetRequested` with the scope, section, and language to reset. |
@@ -695,7 +708,7 @@ import { AgentStudioService, PromptLanguageEditorComponent, TurnStream } from '@
 | `ConversationService` | Transport for Scout's conversation bridge: `submit`, `stream(requestId, turnStream)`, `cancel`. Mount point injected through `CONVERSATION_BASE_PATH`. |
 | `SseParser` | Incremental `text/event-stream` parser: `push(chunk)` returns whole events out of chunks that split anywhere, including between the CR and LF of a CRLF; `finish()` flushes what the closing body left pending. |
 
-Map your audit rows onto `DecisionRecord` to feed the timeline. Style the `.prompt-*`, `.release-*`, `.turn-*`, and `.decision-*` class hooks.
+Map your audit rows onto `DecisionRecord` (outcome `A`, `D`, or `P`, captioned from `audit_decision_outcome`) to feed the timeline. Style the `.prompt-*`, `.release-*`, `.turn-*`, `.decision-*`, `.studio__*`, and `.approval-inbox__*` class hooks. Scout's short codes render through `sailCaption`, a pipe over the backend's constant captions.
 
 ### Conversation transport (v1.1.22)
 
@@ -709,7 +722,7 @@ providers: [{ provide: CONVERSATION_BASE_PATH, useValue: '/api/wingmate/' }]
 
 ```ts
 const stream = new TurnStream(requestId);
-this.conversation.submit({ request_id: requestId, conversation_id: conversationId, agent_id: 'wingmate', input })
+this.conversation.submit({ request_id: requestId, conversation_id: conversationId, agent_type: 'wingmate', input })
   .pipe(switchMap(() => this.conversation.stream(requestId, stream)), takeUntilDestroyed())
   .subscribe({ error: (err) => this.onStreamError(err) });
 ```
@@ -1006,7 +1019,7 @@ Config required in `SAIL_GUI_CONFIG`:
 }
 ```
 
-Under the hood, the component calls `BaseAuthService.loginSocial(provider, idToken, consent)` → `POST /public/login/social` and emits `loginSuccess: LoginResponseSocial`. The session is completed automatically (token stored, app data loaded, routes initialized).
+Under the hood, the component calls `BaseAuthService.loginSocial(provider, idToken, consent)` → `POST /public/login/social` and emits `loginSuccess: LoginResponseSocial`. Apple sends the user's name only on the first authorization and never in the ID token, so that sign-in carries it as `socialName: {firstName?, lastName?}` for the app to pre-fill its profile. The session is completed automatically (token stored, app data loaded, routes initialized).
 
 For backward compatibility, the older OAuth-code flow `BaseAuthService.loginWithGoogle(code)` (hits `/public/login/google`) is still supported; prefer `loginSocial` for new code.
 
@@ -1373,14 +1386,16 @@ These are App Store / Play Store compliance primitives from keel. All are opt-in
 
 ### Re-authentication gate
 
-The four sensitive endpoints below require **recent re-authentication** before they will run — pass `password` and/or `twoFactorCode` to prove the user is still present at the keyboard. The shipped components already capture this; only callers using the service methods directly need to do this.
+The four sensitive endpoints below require **recent re-authentication** before they will run — pass `password`, `twoFactorCode` or `reauthCode` to prove the user is still present at the keyboard. The shipped components already capture this; only callers using the service methods directly need to do this.
 
 | Method | Required re-auth |
 |--------|-----------------|
 | `setup2FA(reauth)` | `password` (or `twoFactorCode` when re-rotating) |
 | `disable2FA(password, code)` | **both** `password` and current TOTP `code` |
-| `deleteAccount(reauth, reason?)` | `password` (or `twoFactorCode`) |
-| `logoutEverywhere(reauth)` | `password` (or `twoFactorCode`) |
+| `deleteAccount(reauth, reason?)` | `password`, `twoFactorCode` or `reauthCode` |
+| `logoutEverywhere(reauth)` | `password`, `twoFactorCode` or `reauthCode` |
+
+An account without a password re-authenticates with `reauthCode`, a one-time code sent by `sendReauthCode(channel?)` (`POST /api/user/reauth/send`; no channel prefers email).
 
 The `ReauthCredentials` type is exported as a shared shape:
 ```typescript
@@ -1392,10 +1407,10 @@ auth.deleteAccount(reauth, 'Closing my account.').subscribe();
 ### Account deletion
 
 ```html
-<sail-account-deletion [confirmationText]="'DELETE'"></sail-account-deletion>
+<sail-account-deletion [confirmationText]="'DELETE'" reauthMethod="code"></sail-account-deletion>
 ```
 
-Typed-confirmation UX: the destructive button is disabled until the user types the exact `confirmationText` (default `DELETE`) **and** confirms their password. Optional reason textarea is forwarded to the backend. On success, local session is cleared and the router navigates to `config.accountDeletedRoute` (default `/login/local`).
+Typed-confirmation UX: the destructive button is disabled until the user types the exact `confirmationText` (default `DELETE`) **and** re-authenticates. `reauthMethod` (`password` default, or `code`) picks the initial method; the user can switch, and the code path sends, resends and submits a `reauthCode`. Optional reason textarea is forwarded to the backend. On success, local session is cleared and the router navigates to `config.accountDeletedRoute` (default `/login/local`).
 
 ### Logout everywhere
 
@@ -1423,6 +1438,7 @@ Platform codes: `'I'` iOS, `'A'` Android, `'W'` Web. The token acquisition (Capa
 |----------|---------------|
 | `DELETE /api/user/account` | `deleteAccount(reauth, reason?)` |
 | `POST /api/user/logout-everywhere` | `logoutEverywhere(reauth)` |
+| `POST /api/user/reauth/send` | `sendReauthCode(channel?)` |
 | `POST /api/push/register` | `registerPushToken(platform, token, appVersion?, deviceModel?)` |
 | `POST /api/push/revoke` | `revokePushToken(token)` |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.32",
+  "version": "1.1.34",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "exports": {

package/src/agent/component/approval_inbox.html

@@ -0,0 +1,63 @@
+<div class="approval-inbox">
+  <section class="approval-inbox__list" aria-label="Pending approvals">
+    @if (requests().length === 0 && !loading()) {
+      <p class="approval-inbox__empty">Nothing is waiting for your decision.</p>
+    }
+    <ul>
+      @for (request of requests(); track key(request)) {
+        <li>
+          <button type="button" class="approval-inbox__item" [class.selected]="key(request) === selectedKey()"
+            [attr.aria-current]="key(request) === selectedKey()" (click)="select(request)">
+            <span class="approval-inbox__summary">{{ request.summary || request.action }}</span>
+            @if (request.deadline_at) {
+              <span class="approval-inbox__deadline">Due {{ request.deadline_at | date: 'medium' }}</span>
+            }
+          </button>
+        </li>
+      }
+    </ul>
+    <button matButton type="button" [disabled]="loading()" (click)="load()">Refresh</button>
+  </section>
+
+  @if (selected(); as request) {
+    <section class="approval-inbox__decision" aria-label="Decision">
+      <h3>{{ request.summary || request.action }}</h3>
+      <dl>
+        <dt>Action</dt><dd>{{ request.action }}</dd>
+        <dt>Resource</dt><dd>{{ request.resource }}</dd>
+        <dt>Effect</dt><dd>{{ request.output_class | sailCaption:'agent_output_class' }}</dd>
+        <dt>Risk tier</dt><dd>{{ request.risk_tier }}</dd>
+        <dt>Required by</dt><dd>{{ request.rule_source | sailCaption:'approval_rule_source' }} · {{ request.rule_id }}</dd>
+        @if (request.approver_reference; as approver) {
+          <dt>Assigned to</dt><dd>{{ approver.kind | sailCaption:'approval_approver_kind' }} {{ approver.ref }} (step {{ request.route_step }})</dd>
+        }
+        @if (request.deadline_at) {
+          <dt>Deadline</dt><dd>{{ request.deadline_at | date: 'medium' }}</dd>
+        }
+        @if (request.revises_step_id) {
+          <dt>Revises</dt><dd>step {{ request.revises_step_id }}</dd>
+        }
+        <dt>Requested</dt><dd>{{ request.created_at | date: 'medium' }}</dd>
+      </dl>
+
+      <mat-form-field>
+        <mat-label>Reason (optional)</mat-label>
+        <textarea matInput rows="2" [value]="reason()" (input)="reason.set($any($event.target).value)"></textarea>
+      </mat-form-field>
+      <mat-form-field>
+        <mat-label>Revised tool arguments (JSON object, for Edit)</mat-label>
+        <textarea matInput rows="4" [value]="revisedArguments()" (input)="revisedArguments.set($any($event.target).value)"></textarea>
+      </mat-form-field>
+
+      <div class="approval-inbox__actions">
+        <button matButton="elevated" type="button" [disabled]="loading()" (click)="decide('A')">Approve</button>
+        <button matButton type="button" class="warn" [disabled]="loading()" (click)="decide('X')">Reject</button>
+        <button matButton type="button" [disabled]="loading() || !revisedArguments().trim()" (click)="decide('E')">Edit and run</button>
+      </div>
+    </section>
+  }
+
+  @if (errorMessage()) {
+    <p class="approval-inbox__error" role="alert">{{ errorMessage() }}</p>
+  }
+</div>

package/src/agent/component/approval_inbox.ts

@@ -0,0 +1,91 @@
+import { DatePipe } from '@angular/common';
+import { ChangeDetectionStrategy, Component, OnInit, computed, inject, output, signal } from '@angular/core';
+import { MatButtonModule } from '@angular/material/button';
+import { MatFormFieldModule } from '@angular/material/form-field';
+import { MatInputModule } from '@angular/material/input';
+import { BaseAsync } from '../../component/abstract/base_async';
+import { CaptionPipe } from '../../service/caption_pipe';
+import { ApprovalRequest, ApprovalVerdict } from '../model/approval';
+import { ApprovalService } from '../service/approval.service';
+
+/**
+ * The signed-in person's pending approvals and a decision view: approve, reject, or edit a
+ * tool call's arguments. A 409 (reassigned or decided elsewhere) reloads the list.
+ * Selector: <sail-approval-inbox>.
+ */
+@Component({
+  selector: 'sail-approval-inbox',
+  changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [DatePipe, MatButtonModule, MatFormFieldModule, MatInputModule, CaptionPipe],
+  templateUrl: './approval_inbox.html',
+})
+export class ApprovalInboxComponent extends BaseAsync implements OnInit {
+  private readonly approvals = inject(ApprovalService);
+
+  readonly decided = output<ApprovalRequest>();
+
+  readonly requests = signal<ApprovalRequest[]>([]);
+  readonly selectedKey = signal('');
+  readonly reason = signal('');
+  readonly revisedArguments = signal('');
+  readonly selected = computed(() => this.requests().find((r) => this.key(r) === this.selectedKey()));
+
+  ngOnInit(): void {
+    this.load();
+  }
+
+  load(): void {
+    this.run(this.approvals.pending(), (rows) => {
+      this.requests.set(rows);
+      if (!this.selected()) this.select(rows[0]);
+    }, 'Failed to load approvals.');
+  }
+
+  select(request: ApprovalRequest | undefined): void {
+    this.selectedKey.set(request ? this.key(request) : '');
+    this.reason.set('');
+    this.revisedArguments.set('');
+  }
+
+  decide(verdict: ApprovalVerdict): void {
+    const request = this.selected();
+    if (!request) return;
+    let revised: Record<string, unknown> | undefined;
+    if (verdict === 'E') {
+      revised = parseObject(this.revisedArguments());
+      if (!revised) {
+        this.errorMessage.set('Revised arguments must be a JSON object.');
+        return;
+      }
+    }
+    this.run(this.approvals.resolve({
+      request_id: request.request_id,
+      execution_step_id: request.execution_step_id,
+      verdict,
+      proposed_digest: request.proposed_digest,
+      reason: this.reason().trim() || undefined,
+      revised_arguments: revised,
+    }), (result) => {
+      this.requests.update((rows) => rows.filter((r) => this.key(r) !== this.key(request)));
+      this.select(this.requests()[0]);
+      this.decided.emit(result);
+    }, 'Failed to record the decision.', (err) => {
+      if ((err as { status?: number })?.status !== 409) return;
+      this.load();
+      this.errorMessage.set('This request was reassigned or decided elsewhere; the list was refreshed.');
+    });
+  }
+
+  key(request: ApprovalRequest): string {
+    return `${request.request_id}#${request.execution_step_id}`;
+  }
+}
+
+function parseObject(text: string): Record<string, unknown> | undefined {
+  try {
+    const value: unknown = JSON.parse(text);
+    return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : undefined;
+  } catch {
+    return undefined;
+  }
+}

package/src/agent/component/decision_timeline.html

@@ -5,14 +5,14 @@
       @for (record of group.records; track record.id) {
         <li
           class="decision-record"
-          [class.decision-record--allow]="record.outcome === 'allow'"
-          [class.decision-record--deny]="record.outcome === 'deny'"
-          [class.decision-record--pending]="record.outcome === 'pending'"
+          [class.decision-record--allow]="record.outcome === 'A'"
+          [class.decision-record--deny]="record.outcome === 'D'"
+          [class.decision-record--pending]="record.outcome === 'P'"
         >
           <time class="decision-record__time" [attr.datetime]="record.occurred_at">{{ record.occurred_at }}</time>
           <span class="decision-record__action">{{ record.action }}</span>
           <span class="decision-record__resource">{{ record.resource }}</span>
-          <span class="decision-record__outcome">{{ record.outcome }}</span>
+          <span class="decision-record__outcome">{{ record.outcome | sailCaption:'audit_decision_outcome' }}</span>
           <span class="decision-record__principal">{{ record.principal.kind }} {{ record.principal.id }}</span>
           @if (record.reason) {
             <p class="decision-record__reason">{{ record.reason }}</p>

package/src/agent/component/decision_timeline.ts

@@ -1,4 +1,5 @@
 import { ChangeDetectionStrategy, Component, computed, input } from '@angular/core';
+import { CaptionPipe } from '../../service/caption_pipe';
 import { DecisionCategoryGroup, DecisionRecord } from '../model/decision';
 
 /**
@@ -8,6 +9,7 @@ import { DecisionCategoryGroup, DecisionRecord } from '../model/decision';
 @Component({
   selector: 'sail-decision-timeline',
   changeDetection: ChangeDetectionStrategy.OnPush,
+  imports: [CaptionPipe],
   templateUrl: './decision_timeline.html',
 })
 export class DecisionTimelineComponent {

package/src/agent/component/prompt_section_editor.html

@@ -37,8 +37,9 @@
             <mat-form-field>
               <mat-label>Merge mode</mat-label>
               <mat-select formControlName="merge_mode">
-                <mat-option value="append">Append</mat-option>
-                <mat-option value="replace">Replace</mat-option>
+                @for (mode of mergeModes(); track mode.code) {
+                  <mat-option [value]="mode.code">{{ mode.caption }}</mat-option>
+                }
               </mat-select>
             </mat-form-field>
             <mat-form-field>
@@ -64,7 +65,7 @@
         } @else {
           <dl class="prompt-layer__readonly">
             <dt>Merge mode</dt>
-            <dd>{{ row.layer.merge_mode }}</dd>
+            <dd>{{ row.layer.merge_mode | sailCaption:'config_merge_mode' }}</dd>
             <dt>Instruction</dt>
             <dd class="prompt-layer__text">{{ row.layer.instruction }}</dd>
             <dt>Output</dt>

package/src/agent/component/prompt_section_editor.ts

@@ -1,5 +1,5 @@
-import { ChangeDetectionStrategy, Component, computed, effect, input, output, signal, untracked } from '@angular/core';
-import { takeUntilDestroyed } from '@angular/core/rxjs-interop';
+import { ChangeDetectionStrategy, Component, computed, effect, inject, input, output, signal, untracked } from '@angular/core';
+import { takeUntilDestroyed, toSignal } from '@angular/core/rxjs-interop';
 import { FormArray, FormControl, FormGroup, ReactiveFormsModule, ValidationErrors } from '@angular/forms';
 import { MatButtonModule } from '@angular/material/button';
 import { MatCheckboxModule } from '@angular/material/checkbox';
@@ -7,6 +7,9 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatIconModule } from '@angular/material/icon';
 import { MatInputModule } from '@angular/material/input';
 import { MatSelectModule } from '@angular/material/select';
+import { map } from 'rxjs';
+import { CaptionPipe } from '../../service/caption_pipe';
+import { LabelOption, LabelService } from '../../service/label.service';
 import { AgentMergeMode, AgentPromptLayer, AgentPromptSection } from '../model/agent_studio';
 
 type LayerForm = FormGroup<{
@@ -25,7 +28,7 @@ export type EditableLayerSlot = 'type' | 'agent';
 
 function layerContentRequired(group: LayerForm): ValidationErrors | null {
   const { instruction, output, merge_mode } = group.getRawValue();
-  if (merge_mode === 'replace') return instruction.trim() ? null : { instructionRequired: true };
+  if (merge_mode === 'R') return instruction.trim() ? null : { instructionRequired: true };
   return instruction.trim() || output.trim() ? null : { contentRequired: true };
 }
 
@@ -37,7 +40,7 @@ function layerContentRequired(group: LayerForm): ValidationErrors | null {
 @Component({
   selector: 'sail-prompt-section-editor',
   changeDetection: ChangeDetectionStrategy.OnPush,
-  imports: [ReactiveFormsModule, MatButtonModule, MatCheckboxModule, MatFormFieldModule, MatIconModule, MatInputModule, MatSelectModule],
+  imports: [ReactiveFormsModule, MatButtonModule, MatCheckboxModule, MatFormFieldModule, MatIconModule, MatInputModule, MatSelectModule, CaptionPipe],
   templateUrl: './prompt_section_editor.html',
 })
 export class PromptSectionEditorComponent {
@@ -49,6 +52,10 @@ export class PromptSectionEditorComponent {
   readonly sectionChange = output<AgentPromptSection>();
   readonly validChange = output<boolean>();
 
+  private readonly labels = inject(LabelService);
+  /** A prompt layer appends or replaces; intersect applies to other settings only. */
+  protected readonly mergeModes = toSignal(this.labels.loadLabels('config_merge_mode').pipe(
+    map(() => this.labels.options('config_merge_mode').filter((o) => o.code !== 'I'))), { initialValue: [] as LabelOption[] });
   protected readonly forms = new FormArray<LayerForm>([]);
   protected readonly rows = signal<LayerRow[]>([]);
   private emitted?: AgentPromptSection;
@@ -95,7 +102,7 @@ export class PromptSectionEditorComponent {
     const layer: AgentPromptLayer = {
       scope_id: slot === 'type' ? this.typeScopeId() : this.agentScopeId(),
       scope_kind: '',
-      merge_mode: 'append',
+      merge_mode: 'A',
       sealed: false,
       editable: true,
       instruction: '',

package/src/agent/component/release_sections.html

@@ -6,7 +6,7 @@
         <h4 class="release-section__caption">{{ section.caption }}</h4>
         <p class="release-section__source">
           Decided by {{ section.source.scope_kind }} scope {{ section.source.scope_id }}
-          ({{ section.source.merge_mode }})
+          ({{ section.source.merge_mode | sailCaption:'config_merge_mode' }})
           @if (section.source.sealed) {
             <span class="release-section__sealed">
               <mat-icon aria-hidden="true">lock</mat-icon>

package/src/agent/component/release_sections.ts

@@ -1,5 +1,6 @@
 import { ChangeDetectionStrategy, Component, computed, input } from '@angular/core';
 import { MatIconModule } from '@angular/material/icon';
+import { CaptionPipe } from '../../service/caption_pipe';
 import { AgentReleaseSection } from '../model/agent_studio';
 
 interface ReleaseLanguageGroup {
@@ -14,7 +15,7 @@ interface ReleaseLanguageGroup {
 @Component({
   selector: 'sail-release-sections',
   changeDetection: ChangeDetectionStrategy.OnPush,
-  imports: [MatIconModule],
+  imports: [MatIconModule, CaptionPipe],
   templateUrl: './release_sections.html',
 })
 export class ReleaseSectionsComponent {