@optimuslabs/harness-map-staging 1.5.36 → 1.5.38

package/dist/agent_access/decision.js

@@ -0,0 +1,20 @@
+/**
+ * Whether an agent may be used, and whether to open the blocked-agent window beside the block
+ * (docs/agent-exception-requests/DESIGN.md). Pure: it reads only what it is given, so the prompt
+ * gate and the tests can call it alike.
+ *
+ * An agent the organization has not approved (Unapproved, or Shadow: never reviewed) is blocked, and
+ * the window opens beside every such block.
+ */
+/** The id an agent is approved under: Claude Desktop's Code tab runs Claude Code. */
+const APPROVAL_ID = { claude_desktop: 'claude' };
+export function approvalId(agent) {
+    return APPROVAL_ID[agent] ?? agent;
+}
+export function agentAccessDecision(agent, approvedAgents) {
+    // Before the first sync nothing is enforced, as for the other approval lists.
+    if (!Array.isArray(approvedAgents))
+        return { allowed: true, window: false };
+    const allowed = approvedAgents.includes(approvalId(agent));
+    return { allowed, window: !allowed };
+}

package/dist/agent_access/window_runner.js

@@ -0,0 +1,129 @@
+/**
+ * Shows the blocked-agent window (docs/agent-exception-requests/DESIGN.md).
+ *
+ * Started detached by the prompt gate (`launchAgentAccessWindow`), so the hook returns its block at
+ * once. Run as `node window_runner.js <agent> [<words.json>]`: an agent's own block reads the window's
+ * words from the synced approvals; a tenant or email-domain block passes them, built by the gate, in
+ * a file of its own temporary folder. It draws the window with `osascript` (macOS only),
+ * then acts on what the user chose: Open launches the approved app, Cancel only closes it. The prompt
+ * was already blocked. Nothing here talks to the network; a failure is logged and never thrown.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { hookRunLog } from '../log_config_files/runtime/hook_logger.js';
+import { readRemediationInstructionsFile } from '../log_config_files/runtime/management_storage.js';
+import { approvalId } from './decision.js';
+const HERE = dirname(fileURLToPath(import.meta.url));
+const WINDOW_SCRIPT = join(HERE, '..', 'agent_block_window', 'agent_block_window.jxa');
+/** The agents the gate checks, by approval id: nothing else is ever passed to a process. */
+const AGENTS = ['claude', 'cursor', 'codex', 'copilot', 'opencode'];
+/** A macOS bundle identifier, and nothing that could be read as an option or a path. */
+const BUNDLE_ID = /^[A-Za-z0-9][A-Za-z0-9.-]{0,254}$/;
+/** Where the gate leaves a login block's words for the runner: a folder of its own under tmpdir. */
+const WORDS_PREFIX = 'optimus-window-words-';
+/** Write a login block's words where only the runner reads them; returns the file's path. */
+function writeWords(words) {
+    const dir = mkdtempSync(join(tmpdir(), WORDS_PREFIX));
+    const path = join(dir, 'words.json');
+    writeFileSync(path, JSON.stringify(words), { mode: 0o600 });
+    return path;
+}
+/**
+ * The words in a file the gate wrote with `writeWords`, and nothing else: the path must be a
+ * `words.json` directly inside one of its folders under tmpdir. The folder is removed once read.
+ */
+export function readWords(path) {
+    try {
+        const real = realpathSync(path);
+        const folder = dirname(real);
+        if (basename(real) !== 'words.json' || dirname(folder) !== realpathSync(tmpdir()))
+            return null;
+        if (!basename(folder).startsWith(WORDS_PREFIX))
+            return null;
+        const words = JSON.parse(readFileSync(real, 'utf8'));
+        rmSync(folder, { recursive: true, force: true });
+        return words && typeof words === 'object' ? words : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The agent's own block window, as remediation sync stored it; undefined when none was synced. */
+function syncedWindow(agent) {
+    return readRemediationInstructionsFile().agent_access_windows?.[approvalId(agent)];
+}
+/**
+ * Start the runner in the background, detached from the hook, on macOS only; true when it started.
+ * `words` are a tenant or email-domain block's, built by the gate; without them the runner reads the
+ * agent's own block window from the synced approvals. False when there is nothing to show (an
+ * approvals file synced before the window existed), so Cursor's hook keeps its own alert.
+ */
+export function launchAgentAccessWindow(agent, words) {
+    if (process.platform !== 'darwin' || !AGENTS.includes(agent))
+        return false;
+    if (!words && !syncedWindow(agent))
+        return false;
+    try {
+        const args = [fileURLToPath(import.meta.url), agent, ...(words ? [writeWords(words)] : [])];
+        const options = { detached: true, stdio: 'ignore' };
+        // An argument list, no shell: an agent from the fixed list above, and the path of a file it wrote.
+        const child = spawn(process.execPath, args, options); // nosafe: SAFE801
+        child.unref();
+        return true;
+    }
+    catch (err) {
+        hookRunLog(`agent_access_window: could not start: ${err instanceof Error ? err.message : String(err)}`);
+        return false;
+    }
+}
+/** Draw the window and return what the user did; null when it could not open. */
+export function showWindow(words) {
+    if (!words)
+        return null;
+    const dir = mkdtempSync(join(tmpdir(), 'optimus-window-'));
+    const payloadPath = join(dir, 'payload.json');
+    try {
+        writeFileSync(payloadPath, JSON.stringify({ words }));
+        const out = spawnSync('osascript', ['-l', 'JavaScript', WINDOW_SCRIPT, payloadPath], { encoding: 'utf8' });
+        if (out.status !== 0) {
+            hookRunLog(`agent_access_window: osascript failed: ${(out.stderr || '').trim()}`);
+            return null;
+        }
+        return JSON.parse(out.stdout.trim());
+    }
+    catch (err) {
+        hookRunLog(`agent_access_window: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+}
+/** Open an app by bundle identifier; anything else is refused. */
+export function openApp(bundleId) {
+    if (!BUNDLE_ID.test(bundleId))
+        return false;
+    // `open -b` with a checked bundle identifier as its only argument, no shell.
+    spawnSync('open', ['-b', bundleId]); // nosafe: SAFE801
+    return true;
+}
+/** Act on what the user chose in the window. */
+export function actOn(result) {
+    if (result.action === 'open')
+        openApp(result.bundle_id ?? '');
+}
+export function runAgentAccessWindow(agent, wordsPath = '') {
+    const words = wordsPath ? readWords(wordsPath) : syncedWindow(agent);
+    const result = showWindow(words ?? undefined);
+    if (result)
+        actOn(result);
+}
+const isEntryPoint = process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1];
+if (isEntryPoint) {
+    const [agent, wordsPath] = process.argv.slice(2);
+    if (agent && AGENTS.includes(agent))
+        runAgentAccessWindow(agent, wordsPath);
+}

package/dist/agent_block_window/agent_block_window.jxa

@@ -0,0 +1,223 @@
+/**
+ * The blocked-agent window (docs/agent-exception-requests/DESIGN.md), run as
+ * `osascript -l JavaScript agent_block_window.jxa <payload.json> [--self-test]`.
+ * Kept as `.jxa` so TypeScript leaves it alone; the build copies it into dist.
+ *
+ * A native macOS window with a web view. Its words come from the backend (`payload.words`); this
+ * script only draws them and prints what the user did as one JSON line:
+ *   {"action": "open", "agent", "bundle_id"} or {"action": "cancel"}
+ * Closing the window, or Escape, is "cancel". Nothing here talks to the network.
+ * `--self-test` makes the page press Cancel by itself once loaded, to check the page-to-script path
+ * without a person.
+ */
+ObjC.import('Cocoa');
+ObjC.import('WebKit');
+
+const WIDTH = 540;
+
+function readPayload(path) {
+  const text = $.NSString.stringWithContentsOfFileEncodingError(path, $.NSUTF8StringEncoding, null);
+  if (text.isNil()) throw new Error(`Cannot read ${path}`);
+  return JSON.parse(text.js);
+}
+
+/** Every payload string goes through this before it reaches the page. */
+function esc(value) {
+  return String(value ?? '')
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+const STYLE = `
+  :root { color-scheme: dark; }
+  * { box-sizing: border-box; }
+  html, body { margin: 0; background: transparent; }
+  body { font: 14px/1.45 -apple-system, BlinkMacSystemFont, "SF Pro Text", sans-serif; color: #e8e8ea;
+         -webkit-user-select: none; cursor: default; }
+  .card { background: #2b2d31; }
+  header { display: flex; align-items: center; justify-content: space-between; padding: 16px 20px;
+           border-bottom: 1px solid #3a3c41; }
+  .brand { display: flex; align-items: center; gap: 10px; font-weight: 600; font-size: 15px; color: #cfd0d3; }
+  .logo { flex: none; width: 24px; height: 24px; border-radius: 50%; background: #c9f2cf; color: #15361c;
+          display: grid; place-items: center; font: 700 12px/1 ui-rounded, -apple-system, sans-serif; }
+  .logo.big { width: 44px; height: 44px; font-size: 18px; }
+  .scope { font-size: 13px; color: #b7b8bc; }
+  main { padding: 22px 20px 18px; }
+  h1 { font-size: 22px; line-height: 1.25; font-weight: 700; margin: 0 0 16px; color: #fff; }
+  .box { border-radius: 10px; padding: 14px 16px; margin-bottom: 14px; }
+  .reason { background: #3a2224; border: 1px solid #7a3d3d; display: flex; gap: 12px; }
+  .reason .icon { flex: none; width: 18px; height: 18px; margin-top: 2px; border: 1.6px solid #f0a8a8;
+                  border-radius: 50%; color: #f0a8a8; display: grid; place-items: center; font: 700 11px/1 sans-serif; }
+  .reason strong { display: block; color: #fff; font-size: 15px; margin-bottom: 4px; }
+  .reason p { margin: 0; color: #dedee0; }
+  .reason hr { border: 0; border-top: 1px solid #7a3d3d; margin: 12px 0 10px; }
+  .findings { display: grid; grid-template-columns: max-content 1fr; gap: 6px 16px; margin: 0; }
+  .findings dt { font-size: 12px; font-weight: 700; letter-spacing: .06em; color: #f0d58a; padding-top: 1px; }
+  .findings dt.critical, .findings dt.high { color: #f0a8a8; }
+  .findings dt.low, .findings dt.unknown { color: #b7b8bc; }
+  .findings dd { margin: 0; color: #dedee0; }
+  .path { background: #2c382f; border: 1px solid #3f6a47; }
+  .row { display: flex; align-items: center; gap: 16px; }
+  .grow { flex: 1; }
+  .label { font-size: 11.5px; font-weight: 700; letter-spacing: .08em; text-transform: uppercase; color: #8fd39a; }
+  .path h2 { margin: 4px 0 2px; font-size: 16px; color: #fff; }
+  .path p { margin: 0; color: #b9bdb9; font-size: 13px; }
+  .path p.sub { color: #d4e7d7; font-size: 13.5px; margin-bottom: 4px; }
+  .path hr { border: 0; border-top: 1px solid #44574a; margin: 14px 0 12px; }
+  .also { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; color: #b9bdb9; font-size: 13px; }
+  .chip { background: #2f3134; border: 1px solid #4b4d52; border-radius: 7px; padding: 5px 12px; color: #e8e8ea; font-size: 13px; }
+  button { font: inherit; cursor: pointer; border-radius: 8px; }
+  .primary { background: #2f6fdb; color: #fff; border: 0; padding: 10px 22px; font-weight: 600; font-size: 14px; white-space: nowrap; }
+  .primary:hover { background: #3a7bea; }
+  .secondary { background: #3a3c41; color: #e8e8ea; border: 1px solid #4b4d52; padding: 8px 20px; font-size: 14px; }
+  .secondary:hover { background: #44464b; }
+  .link { background: none; border: 0; padding: 0; color: #7fb0ff; text-decoration: underline; font-size: 14px; }
+  footer { display: flex; align-items: center; justify-content: space-between; padding: 14px 20px;
+           border-top: 1px solid #3a3c41; gap: 12px; }
+`;
+
+function header(w, withScope) {
+  return `<header><div class="brand"><span class="logo">o/</span>${esc(w.brand)}</div>${
+    withScope ? `<div class="scope">${esc(w.scope)}</div>` : ''
+  }</header>`;
+}
+
+function openButton(app) {
+  return app ? `<button class="primary" data-open="${esc(app.agent)}" data-bundle="${esc(app.bundle_id)}">${esc(app.open)}</button>` : '';
+}
+
+/** The other approved agents, as chips under their label; '' when there are none. */
+function alsoApproved(w) {
+  const chips = (w.also_approved?.agents ?? []).map((a) => `<span class="chip">${esc(a.name)}</span>`).join('');
+  return chips ? `<div class="also">${esc(w.also_approved.label)} ${chips}</div>` : '';
+}
+
+function pathCard(w) {
+  const best = w.best_match;
+  // With nothing in the blocked agent's category to open, the other approved agents still show.
+  if (!best) {
+    const others = alsoApproved(w);
+    return others ? `<section class="box path">${others}</section>` : '';
+  }
+  const others = alsoApproved(w);
+  const also = others ? `<hr>${others}` : '';
+  // A login block names the account to use but has nothing to open, so no button.
+  const button = best.bundle_id ? openButton(best) : '';
+  const subtitle = best.subtitle ? `<p class="sub">${esc(best.subtitle)}</p>` : '';
+  return `<section class="box path"><div class="row"><div class="grow">
+      <div class="label">${esc(best.label)}</div><h2>${esc(best.title)}</h2>${subtitle}<p>${esc(best.body)}</p>
+    </div>${button}</div>${also}</section>`;
+}
+
+/** A skill's scan findings under the reason, by severity ({severity, label, text}); '' when none. */
+function findings(reason) {
+  const rows = (reason?.findings ?? [])
+    .map((f) => {
+      const level = ['critical', 'high', 'medium', 'low'].includes(f.severity) ? f.severity : 'unknown';
+      return `<dt class="${level}">${esc(f.label)}</dt><dd>${esc(f.text)}</dd>`;
+    })
+    .join('');
+  return rows ? `<hr><dl class="findings">${rows}</dl>` : '';
+}
+
+function formView(w) {
+  const body = w.reason?.body ? `<p>${esc(w.reason.body)}</p>` : '';
+  return `${header(w, true)}<main>
+      <h1>${esc(w.title)}</h1>
+      <section class="box reason"><span class="icon">!</span>
+        <div class="grow"><strong>${esc(w.reason?.title)}</strong>${body}${findings(w.reason)}</div></section>
+      ${pathCard(w)}
+    </main>
+    <footer><span></span><button class="secondary" data-close="cancel">${esc(w.cancel)}</button></footer>`;
+}
+
+function pageHtml(p, selfTest) {
+  return `<!doctype html><html><head><meta charset="utf-8"><style>${STYLE}</style></head><body>
+  <div class="card" id="card">${formView(p.words)}</div>
+  <script>
+    const post = (m) => window.webkit.messageHandlers.optimus.postMessage(JSON.stringify(m));
+    const size = () => window.webkit.messageHandlers.optimus.postMessage(JSON.stringify({ type: 'size', height: document.getElementById('card').offsetHeight }));
+    document.querySelectorAll('[data-close]').forEach((b) => b.onclick = () => post({ action: b.dataset.close }));
+    document.querySelectorAll('[data-open]').forEach((b) => b.onclick = () => post({ action: 'open', agent: b.dataset.open, bundle_id: b.dataset.bundle }));
+    document.addEventListener('keydown', (e) => { if (e.key === 'Escape') post({ action: 'cancel' }); });
+    window.addEventListener('load', size);
+    ${selfTest ? "window.addEventListener('load', () => setTimeout(() => post({ action: 'cancel' }), 300));" : ''}
+  </script></body></html>`;
+}
+
+function place(win, height) {
+  win.setContentSize($.NSMakeSize(WIDTH, Math.min(Math.max(height, 120), 900)));
+  win.center;
+}
+
+function run(argv) {
+  const payload = readPayload(argv[0]);
+  const app = $.NSApplication.sharedApplication;
+  app.setActivationPolicy($.NSApplicationActivationPolicyAccessory);
+  app.finishLaunching;
+
+  let result = null;
+  let win = null;
+  ObjC.registerSubclass({
+    name: 'OptimusBlockWindowHandler',
+    superclass: 'NSObject',
+    // Not declared as conforming to WKScriptMessageHandler: osascript cannot see that protocol, and
+    // WebKit only needs the method below.
+    methods: {
+      'userContentController:didReceiveScriptMessage:': {
+        types: ['void', ['id', 'id']],
+        implementation: function (_controller, message) {
+          const m = JSON.parse(ObjC.unwrap(message.body));
+          if (m.type === 'size') {
+            place(win, m.height);
+            return;
+          }
+          result = m;
+        },
+      },
+    },
+  });
+
+  const config = $.WKWebViewConfiguration.alloc.init;
+  config.userContentController.addScriptMessageHandlerName($.OptimusBlockWindowHandler.alloc.init, 'optimus');
+
+  const width = WIDTH;
+  const style = $.NSWindowStyleMaskTitled | $.NSWindowStyleMaskClosable | $.NSWindowStyleMaskFullSizeContentView;
+  win = $.NSWindow.alloc.initWithContentRectStyleMaskBackingDefer($.NSMakeRect(0, 0, width, 480), style, $.NSBackingStoreBuffered, false);
+  win.titlebarAppearsTransparent = true;
+  win.titleVisibility = $.NSWindowTitleHidden;
+  win.movableByWindowBackground = true;
+  win.appearance = $.NSAppearance.appearanceNamed($.NSAppearanceNameDarkAqua);
+  win.backgroundColor = $.NSColor.colorWithSRGBRedGreenBlueAlpha(43 / 255, 45 / 255, 49 / 255, 1);
+  win.level = $.NSFloatingWindowLevel;
+  for (const button of [$.NSWindowMiniaturizeButton, $.NSWindowZoomButton]) {
+    win.standardWindowButton(button).hidden = true;
+  }
+
+  const web = $.WKWebView.alloc.initWithFrameConfiguration($.NSMakeRect(0, 0, width, 480), config);
+  web.setValueForKey($.NSNumber.numberWithBool(false), 'drawsBackground');
+  web.loadHTMLStringBaseURL($(pageHtml(payload, argv[1] === '--self-test')), $.NSURL.URLWithString('about:blank'));
+  win.contentView = web;
+  win.center;
+  win.makeKeyAndOrderFront(null);
+  app.activateIgnoringOtherApps(true);
+
+  // Pump events ourselves: osascript has no running NSApplication loop to hand them to the window.
+  // NSAnyEventMask, not NSEventMaskAny: the newer constant is all 64 bits, which a JavaScript number
+  // rounds to a mask matching no event at all; the old one arrives as -1, every bit set.
+  while (result === null) {
+    const event = app.nextEventMatchingMaskUntilDateInModeDequeue(
+      $.NSAnyEventMask,
+      $.NSDate.dateWithTimeIntervalSinceNow(0.1),
+      $.NSDefaultRunLoopMode,
+      true,
+    );
+    if (!event.isNil()) app.sendEvent(event);
+    if (!win.isVisible) result = { action: 'cancel' };
+  }
+  win.orderOut(null);
+  return JSON.stringify(result);
+}

package/dist/approved_tenant_gate.js

@@ -159,6 +159,81 @@ export function companyName(approved) {
         .map(nameOf));
     return names.size === 1 ? [...names][0] : '';
 }
+/** The one account to name: the approved one, else the company's; '' for several or none known. */
+function accountOf(block) {
+    if (block.approved.length === 1)
+        return block.approved[0];
+    return block.approved.length ? '' : block.company;
+}
+/** The one-line block message, as the agent shows it. */
+export function tenantBlockText(block) {
+    const account = accountOf(block);
+    if (block.agent !== 'cursor' || !account) {
+        return tenantBlockMessage(block.agent, block.approved, block.signedIn, block.company);
+    }
+    const domains = block.domains.length ? ` (${block.domains.join(', ')})` : '';
+    return (`${ORGANIZATION_LEAD} does not allow Cursor to be signed in to ${block.signedIn}. ` +
+        `The approved organization's team account for Cursor is ${account}${domains}. ` +
+        'Please sign out and sign in with the approved account to use Cursor.');
+}
+/** What an approved account is called, per agent: "team account" for Cursor's teams. */
+const ACCOUNT_NOUN = {
+    claude: 'organization',
+    claude_desktop: 'organization',
+    cursor: 'team account',
+    codex: 'workspace',
+};
+/** A login block's window has nothing to open, so its one button only acknowledges: OK. */
+function loginWindow(title, reason, path) {
+    return { brand: 'Optimus Labs', scope: 'Org-wide policy', title, reason, best_match: path, cancel: 'OK' };
+}
+/** When personal accounts on an email domain are what is approved: "your optimuslabs.io account". */
+function personalPathCard(name, domains) {
+    return {
+        label: 'Approved path',
+        title: domains.length === 1 ? `Sign in with your ${domains[0]} account` : 'Sign in with an account on one of these domains',
+        subtitle: domains.length === 1 ? '' : domains.join(', '),
+        body: `Sign out of ${name}, then sign in with that account.`,
+    };
+}
+/** When nothing is approved to switch to: say so, and point at an admin rather than an account. */
+function noPathCard(name, kind) {
+    return {
+        label: 'What to do',
+        title: 'Ask an admin which account to use',
+        subtitle: '',
+        body: `Your organisation hasn't approved a ${name} ${kind} yet. Sign out of ${name}, then sign in with your work account once an admin has approved it.`,
+    };
+}
+/** The window for a login whose tenant is refused: what it is signed in to, and what to use instead. */
+export function tenantBlockWindow(block) {
+    const words = TENANT_WORDS[block.agent];
+    const account = accountOf(block);
+    const title = `${words.name} is signed in to an account your organisation doesn't allow`;
+    const reason = {
+        title: block.personal ? "It's a personal account." : `It isn't an approved ${words.kind}.`,
+        body: 'Agents signed in to accounts outside your organisation can send its code and data there.',
+    };
+    // An approved path is something approved for this agent itself: a team, or personal accounts on
+    // an email domain. The company's name alone (from another agent's tenant, such as a Claude
+    // organization) is not one, so it gets What to do.
+    if (!block.approved.length && block.personalDomains.length) {
+        return loginWindow(title, reason, personalPathCard(words.name, block.personalDomains));
+    }
+    if (!block.approved.length)
+        return loginWindow(title, reason, noPathCard(words.name, words.kind));
+    const how = block.agent === 'cursor'
+        ? 'Sign out of Cursor, then sign in with that account.'
+        : switchStep(block.agent, block.approved, block.company);
+    return loginWindow(title, reason, {
+        label: 'Approved path',
+        title: account
+            ? `Sign in with your ${account} ${ACCOUNT_NOUN[block.agent]}`
+            : `Sign in with one of: ${block.approved.join(', ')}`,
+        subtitle: block.domains.join(', '),
+        body: how,
+    });
+}
 const CLAUDE_PERSONAL_PLANS = new Set(['free', 'pro', 'max']);
 /** "a personal Max account (gmail.com)" or "the Beta Corp organization". */
 function claudeSignedInText(signedIn) {
@@ -184,14 +259,27 @@ function tenantIds(tenants) {
  * awaiting review and gets through, as an approved one does. Ids compare exactly, as the backend
  * does -- vendor ids are not ours to case-fold.
  */
-export function approvedTenantViolation(agent, approved, signedIn) {
+export function approvedTenantBlock(agent, approved, signedIn) {
     if (!signedIn)
         return null;
     const policy = approved?.[agent];
     const signedInId = signedIn.tenant_id.trim();
     if (!tenantIds(policy?.unapproved_tenants).some((t) => t.tenant_id.trim() === signedInId))
         return null;
-    return tenantBlockMessage(agent, tenantIds(policy?.tenants).map(nameOf), claudeSignedInText(signedIn), companyName(approved));
+    const signedInText = claudeSignedInText(signedIn);
+    return {
+        agent,
+        signedIn: signedInText,
+        personal: signedInText.startsWith('a personal'),
+        approved: tenantIds(policy?.tenants).map(nameOf),
+        company: companyName(approved),
+        domains: [],
+        personalDomains: [],
+    };
+}
+export function approvedTenantViolation(agent, approved, signedIn) {
+    const block = approvedTenantBlock(agent, approved, signedIn);
+    return block ? tenantBlockText(block) : null;
 }
 /**
  * The tenants a Cursor login is in: its teams, or, on no team, `@` and its email domain. Mirrors the
@@ -227,7 +315,14 @@ function listedTenantViolation(policy, tenants) {
     const unapprovedList = tenantIds(policy?.unapproved_tenants);
     if (!tenants.length || !tenants.every((id) => isListed(unapprovedList, id)))
         return null;
-    return { approved: tenantIds(policy?.tenants).map(nameOf) };
+    // Approved personal-account keys (`@acme.io`) are not teams to sign in to: never named as one,
+    // but kept as the email domains whose personal accounts are approved.
+    const approved = tenantIds(policy?.tenants);
+    const isPersonal = (t) => t.tenant_id.trim().startsWith('@');
+    return {
+        approved: approved.filter((t) => !isPersonal(t)).map(nameOf),
+        personalDomains: approved.filter(isPersonal).map((t) => t.tenant_id.trim().slice(1)),
+    };
 }
 function isListed(list, id) {
     return list.some((t) => t.tenant_id.trim() === id);
@@ -259,22 +354,27 @@ function codexSignedInText(signedIn, tenants, policy) {
     return name ? `the ${name} workspace` : `workspace ${tenant}`;
 }
 /** The block message when Cursor's login may not be used, else null. */
-export function cursorTeamViolation(approved, signedIn, teamDomains = []) {
+export function cursorTeamBlock(approved, signedIn, teamDomains = []) {
     if (!signedIn)
         return null;
     const v = listedTenantViolation(approved?.cursor, cursorTenants(signedIn));
     if (!v)
         return null;
     const signedInText = cursorSignedInText(signedIn, approved?.cursor);
-    // The one account to point at: the approved team, else the company's name. Several approved
-    // teams, or no name known, keep the generic message.
-    const account = v.approved.length === 1 ? v.approved[0] : v.approved.length ? '' : companyName(approved);
-    if (!account)
-        return tenantBlockMessage('cursor', v.approved, signedInText);
-    const domains = teamDomains.length ? ` (${teamDomains.join(', ')})` : '';
-    return (`${ORGANIZATION_LEAD} does not allow Cursor to be signed in to ${signedInText}. ` +
-        `The approved organization's team account for Cursor is ${account}${domains}. ` +
-        'Please sign out and sign in with the approved account to use Cursor.');
+    // The one account to point at is the approved team, else the company's name (accountOf).
+    return {
+        agent: 'cursor',
+        signedIn: signedInText,
+        personal: signedInText === 'a personal account',
+        approved: v.approved,
+        company: companyName(approved),
+        domains: teamDomains,
+        personalDomains: v.personalDomains,
+    };
+}
+export function cursorTeamViolation(approved, signedIn, teamDomains = []) {
+    const block = cursorTeamBlock(approved, signedIn, teamDomains);
+    return block ? tenantBlockText(block) : null;
 }
 /**
  * Codex plans that are personal, mirroring the backend's `CodexPlans.PERSONAL`. On one of these
@@ -313,14 +413,27 @@ function codexEmailDomainTenant(signedIn) {
     return at >= 0 && at < email.length - 1 ? [`@${email.slice(at + 1).toLowerCase()}`] : [];
 }
 /** The block message when Codex's login may not be used, else null. */
-export function codexTenantViolation(approved, signedIn) {
+export function codexTenantBlock(approved, signedIn) {
     const tenants = signedIn ? codexTenants(signedIn) : null;
     if (!tenants)
         return null;
     const v = listedTenantViolation(approved?.codex, tenants);
     if (!v)
         return null;
-    return tenantBlockMessage('codex', v.approved, codexSignedInText(signedIn, tenants, approved?.codex), companyName(approved));
+    const signedInText = codexSignedInText(signedIn, tenants, approved?.codex);
+    return {
+        agent: 'codex',
+        signedIn: signedInText,
+        personal: signedInText.startsWith('a personal'),
+        approved: v.approved,
+        company: companyName(approved),
+        domains: [],
+        personalDomains: v.personalDomains,
+    };
+}
+export function codexTenantViolation(approved, signedIn) {
+    const block = codexTenantBlock(approved, signedIn);
+    return block ? tenantBlockText(block) : null;
 }
 /**
  * The org Claude Desktop is signed into now, for its Code tab's prompts, or null when unknown.
@@ -346,24 +459,36 @@ export function readClaudeDesktopSignedInTenant(home = homedir(), env = process.
         plan: same ? fromClaudeCode.plan : '',
     };
 }
-/**
- * The block message when a login's email is on a domain the organization unapproved, else null.
- *
- * Unapproving a domain covers every agent and every address on it, and its subdomains
- * (`mail.acme.com` falls under `acme.com`), the way an approved domain covers them.
- */
-export function unapprovedEmailDomainViolation(email, unapproved) {
+export function unapprovedEmailDomainBlock(email, unapproved) {
     const address = (email ?? '').trim().toLowerCase();
     const at = address.lastIndexOf('@');
     if (at < 0 || !unapproved?.length)
         return null;
     const domain = address.slice(at + 1);
     const hit = unapproved.find((d) => domain === d || domain.endsWith(`.${d}`));
-    if (!hit)
+    return hit ? { domain: hit, address } : null;
+}
+export function unapprovedEmailDomainViolation(email, unapproved) {
+    const block = unapprovedEmailDomainBlock(email, unapproved);
+    if (!block)
         return null;
-    return (`This device doesn't allow accounts on ${hit}. You're signed in as ${address}. ` +
+    return (`This device doesn't allow accounts on ${block.domain}. You're signed in as ${block.address}. ` +
         'Sign in with your work account.');
 }
+/** The window for a login on an unapproved email domain. `agent` is one the gate reads logins for. */
+export function emailDomainBlockWindow(agent, block, teamDomains = []) {
+    const name = TENANT_WORDS[agent]?.name ?? agent;
+    return loginWindow(`${name} is signed in with an email your organisation doesn't allow`, {
+        title: `Accounts on ${block.domain} aren't allowed.`,
+        body: `You're signed in as ${block.address}. Your organisation doesn't allow this email domain in any agent.`,
+    }, {
+        // With a team domain to name there is an approved path; without one, only advice.
+        label: teamDomains.length ? 'Approved path' : 'What to do',
+        title: 'Sign in with your work account',
+        subtitle: teamDomains.join(', '),
+        body: `Sign out of ${name}, then sign in with your work email.`,
+    });
+}
 /** The id an agent is approved under on the Agents page: Desktop's Code tab runs Claude Code. */
 const APPROVAL_ID = { claude_desktop: 'claude' };
 const AGENT_NAME = {