@stigmer/react 3.15.3-dev.20260914121148 → 3.15.3-dev.20260916211208

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/react",
-  "version": "3.15.3-dev.20260914121148",
+  "version": "3.15.3-dev.20260916211208",
   "description": "React provider and client hook for the Stigmer platform SDK",
   "license": "Apache-2.0",
   "type": "module",
@@ -37,7 +37,7 @@
   "dependencies": {
     "@bufbuild/protovalidate": "^1.1.1",
     "@dagrejs/dagre": "^1.1.4",
-    "@stigmer/theme": "3.15.3-dev.20260914121148",
+    "@stigmer/theme": "3.15.3-dev.20260916211208",
     "diff": "^8.0.3",
     "fflate": "^0.8.2",
     "hast-util-to-jsx-runtime": "^2.3.6",
@@ -60,8 +60,8 @@
     "@codemirror/state": "^6.0.0",
     "@codemirror/view": "^6.0.0",
     "@lezer/highlight": "^1.0.0",
-    "@stigmer/protos": "3.15.3-dev.20260914121148",
-    "@stigmer/sdk": "3.15.3-dev.20260914121148",
+    "@stigmer/protos": "3.15.3-dev.20260916211208",
+    "@stigmer/sdk": "3.15.3-dev.20260916211208",
     "@tanstack/react-table": "^8.20.0",
     "@xyflow/react": "^12.0.0",
     "elkjs": "^0.9.0",

package/sharing/useCanCreateAgentShare.d.ts

@@ -28,10 +28,11 @@ export interface UseCanCreateAgentShareReturn {
  *   resource id — an Organization's id equals its slug
  *   (ApiResourceMetadata.id).
  *
- * On the open-source edition both checks reach the server's permissive
- * single-team authorizer and answer allowed — the same posture the
- * backend enforces there (decision 011 D4), so the affordance matches
- * what a create would do.
+ * On the open-source edition the answer follows the server's posture. A
+ * server without sign-in has the permissive single-team authorizer and
+ * answers allowed (decision 011 D4). A server with sign-in enforces the
+ * same organization roles as the cloud, so `can_create_agent_share` is
+ * the admin's and a member sees no share affordance.
  *
  * Pass `null` for `agent` while it loads — `allowed` stays `false` so
  * no affordance flashes before the gate can be evaluated.

package/sharing/useCanCreateAgentShare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useCanCreateAgentShare.d.ts","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AAIhF,sDAAsD;AACtD,MAAM,WAAW,4BAA4B;IAC3C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,4BAA4B,CAuB9B"}
+{"version":3,"file":"useCanCreateAgentShare.d.ts","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,oDAAoD,CAAC;AAIhF,sDAAsD;AACtD,MAAM,WAAW,4BAA4B;IAC3C,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,gFAAgF;IAChF,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,KAAK,GAAG,IAAI,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,4BAA4B,CAuB9B"}

package/sharing/useCanCreateAgentShare.js

@@ -17,10 +17,11 @@ import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
  *   resource id — an Organization's id equals its slug
  *   (ApiResourceMetadata.id).
  *
- * On the open-source edition both checks reach the server's permissive
- * single-team authorizer and answer allowed — the same posture the
- * backend enforces there (decision 011 D4), so the affordance matches
- * what a create would do.
+ * On the open-source edition the answer follows the server's posture. A
+ * server without sign-in has the permissive single-team authorizer and
+ * answers allowed (decision 011 D4). A server with sign-in enforces the
+ * same organization roles as the cloud, so `can_create_agent_share` is
+ * the admin's and a member sees no share affordance.
  *
  * Pass `null` for `agent` while it loads — `allowed` stays `false` so
  * no affordance flashes before the gate can be evaluated.

package/sharing/useCanCreateAgentShare.js.map

@@ -1 +1 @@
-{"version":3,"file":"useCanCreateAgentShare.js","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAgBzE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmB,EACnB,SAAkB;IAElB,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GACZ,KAAK,EAAE,QAAQ,EAAE,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,CAAC;IAE1E,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAClD,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAC9D,UAAU,CACX,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,kBAAkB,CACpD,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EACtE,wBAAwB,CACzB,CAAC;IAEF,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAEtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"useCanCreateAgentShare.js","sourceRoot":"","sources":["../../src/sharing/useCanCreateAgentShare.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAGb,OAAO,EAAE,qBAAqB,EAAE,MAAM,wDAAwD,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AAgBzE;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAmB,EACnB,SAAkB;IAElB,MAAM,OAAO,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAAG,SAAS,IAAI,QAAQ,CAAC;IACvC,MAAM,UAAU,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GACZ,KAAK,EAAE,QAAQ,EAAE,UAAU,KAAK,qBAAqB,CAAC,iBAAiB,CAAC;IAE1E,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,kBAAkB,CAClD,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAC9D,UAAU,CACX,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,kBAAkB,CACpD,UAAU,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EACtE,wBAAwB,CACzB,CAAC;IAEF,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,IAAI,cAAc,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAEtE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC"}

package/src/execution/ApprovalCard.tsx

@@ -13,8 +13,10 @@ import {
   resolveToolCategoryFromKind,
   extractPrimaryArgFromPreview,
   extractShellIntentFromPreview,
-  extractWriteContentFromPreview,
+  extractWriteContentFromArgs,
   isFileCategory,
+  parseArgsPreview,
+  withAuthoritativeWriteContent,
   type ToolCategory,
 } from "./tool-categories.js";
 import { CATEGORY_ICON } from "./ToolCallItem.js";
@@ -233,6 +235,17 @@ export function ApprovalCardHeader({
 export interface ApprovalCardBodyProps {
   /** The pending approval to render a decision panel for. */
   readonly pendingApproval: PendingApproval;
+  /**
+   * The gated tool row's authoritative arguments (`ToolCall.args`), when the
+   * caller holds the row — the inline gate on a {@link ToolCallItem} does.
+   * They supply the proposed write/edit content, which the pending approval's
+   * `argsPreview` (the runner's sanitized summary) cannot carry for a file of
+   * any real size; every other field the card shows still comes from the
+   * preview, so nothing the runner redacted becomes visible. Absent, the card
+   * renders from the preview alone and a large write shows the "no preview"
+   * notice rather than its content.
+   */
+  readonly args?: Record<string, unknown>;
   /** Called when the user picks Approve / Approve-all / Skip / Reject. */
   readonly onSubmit: (action: ApprovalAction, comment?: string) => void;
   /** True while the RPC for this tool call is in flight. */
@@ -245,13 +258,16 @@ export interface ApprovalCardBodyProps {
 
 /**
  * The decision panel of an approval: the optional message and gate reason, the
- * file-changes / args preview, and the action buttons. Reused in two places —
- * the standalone {@link ApprovalCard} (with {@link ApprovalCardHeader} above
- * it) and inline inside a gated {@link ToolCallItem}'s expanded panel, where
- * the item's own row is the header. One body, identical preview in both.
+ * proposed change (the write/edit content from the row's `args` when the caller
+ * holds the row, the sanitized args preview otherwise), and the action buttons.
+ * Reused in two places — the standalone {@link ApprovalCard} (with
+ * {@link ApprovalCardHeader} above it) and inline inside a gated
+ * {@link ToolCallItem}'s expanded panel, where the item's own row is the header.
+ * One body, one preview rule in both.
  */
 export function ApprovalCardBody({
   pendingApproval,
+  args,
   onSubmit,
   isSubmitting = false,
   error = null,
@@ -279,18 +295,17 @@ export function ApprovalCardBody({
     pendingApproval.mcpServerSlug,
   );
 
-  const parsedArgs = useMemo<Record<string, unknown> | null>(() => {
-    if (!pendingApproval.argsPreview) return null;
-    try {
-      const parsed = JSON.parse(pendingApproval.argsPreview);
-      if (typeof parsed === "object" && parsed !== null) {
-        return parsed as Record<string, unknown>;
-      }
-      return null;
-    } catch {
-      return null;
-    }
-  }, [pendingApproval.argsPreview]);
+  // What the card shows: the preview's fields (the runner's sanitized summary),
+  // with the proposed write/edit content overlaid from the row's authoritative
+  // `args` when the caller holds the row — the one value the summary cannot
+  // carry for a file of any real size, and the one the user is asked to approve.
+  // A preview that does not parse (a record persisted under an older runner's
+  // whole-string truncation) stays `null`: nothing is overlaid onto a summary
+  // the card cannot read, and the notice below says so honestly.
+  const displayArgs = useMemo<Record<string, unknown> | null>(() => {
+    const previewArgs = parseArgsPreview(pendingApproval.argsPreview);
+    return previewArgs ? withAuthoritativeWriteContent(previewArgs, args) : null;
+  }, [pendingApproval.argsPreview, args]);
 
   // APPROVE_ALL now grants a run-lifetime lease scoped to the clicked tool's
   // CLASS — its MCP server for an MCP tool, else its approval category (where
@@ -327,11 +342,11 @@ export function ApprovalCardBody({
   const isWriteEdit =
     categoryInfo.category === "write" || categoryInfo.category === "edit";
 
-  // The proposed write/edit content from the args preview, when the gate carries
-  // no authoritative file_changes capture. Drives the three-way fallback below.
+  // The proposed write/edit content, when the gate carries no authoritative
+  // file_changes capture. Drives the three-way fallback below.
   const writeContent = useMemo(
-    () => extractWriteContentFromPreview(pendingApproval.argsPreview),
-    [pendingApproval.argsPreview],
+    () => (displayArgs ? extractWriteContentFromArgs(displayArgs) : null),
+    [displayArgs],
   );
 
   // The decision-relevant preview. The pre-execution deny-gate is an
@@ -353,11 +368,11 @@ export function ApprovalCardBody({
     const kind =
       pendingApproval.toolKind === ToolKind.FILE_WRITE ? "create" : "no-preview";
     preview = <EmptyChangeNotice kind={kind} />;
-  } else if (parsedArgs) {
+  } else if (displayArgs) {
     preview = (
       <ToolArgsView
         toolName={pendingApproval.toolName}
-        args={parsedArgs}
+        args={displayArgs}
         mcpServerSlug={pendingApproval.mcpServerSlug}
         showFileName={!isWriteEdit}
       />

package/src/execution/ToolArgsView.tsx

@@ -4,7 +4,7 @@ import { useMemo } from "react";
 import { cn } from "@stigmer/theme";
 import {
   resolveToolCategory,
-  extractWriteContentFromPreview,
+  extractWriteContentFromArgs,
 } from "./tool-categories.js";
 import type { ToolCategory, ToolCategoryInfo } from "./tool-categories.js";
 import { FilePathLink } from "./FilePathLink.js";
@@ -239,25 +239,6 @@ function GenericArgsView({ args }: { args: Record<string, unknown> }) {
 // Utilities
 // ---------------------------------------------------------------------------
 
-const WRITE_CONTENT_FIELDS = [
-  "contents",
-  "content",
-  "file_content",
-  "new_text",
-  "new_string",
-  "replacement",
-] as const;
-
-function extractWriteContentFromArgs(
-  args: Record<string, unknown>,
-): string | null {
-  for (const field of WRITE_CONTENT_FIELDS) {
-    const val = args[field];
-    if (typeof val === "string" && val.length > 0) return val;
-  }
-  return null;
-}
-
 function extractPrimaryArgValue(
   args: Record<string, unknown> | null,
   info: ToolCategoryInfo,

package/src/execution/ToolCallItem.tsx

@@ -360,8 +360,12 @@ export const ToolCallItem = memo(function ToolCallItem({
     // The row above is this approval's header, so render only the body (preview
     // + actions). The enclosing card already carries the border + warning/
     // destructive accent for a pending gate, so the body renders borderless.
+    // This row holds the call's authoritative `args`; the body reads the
+    // proposed write content from them, which the approval's sanitized preview
+    // cannot carry for a file of any real size (stigmer#1107).
     <ApprovalCardBody
       pendingApproval={approval.pendingApproval}
+      args={toolCall.args}
       onSubmit={approval.onSubmit}
       isSubmitting={approval.isSubmitting}
       error={approval.error}

package/src/execution/__tests__/ApprovalCard.test.tsx

@@ -7,7 +7,7 @@ import {
   ApprovalPolicySource,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import { ToolKind } from "@stigmer/sdk";
-import { ApprovalCard } from "../ApprovalCard";
+import { ApprovalCard, ApprovalCardBody } from "../ApprovalCard";
 
 // Under apply-then-review the deny-gate carries no captured `file_changes`
 // (message.proto field 14 was removed in Phase 5 Slice 4); the gate renders the
@@ -451,6 +451,115 @@ describe("ApprovalCard file-change preview", () => {
   });
 });
 
+// ---------------------------------------------------------------------------
+// The proposed content comes from the row's authoritative args (stigmer#1107)
+//
+// `argsPreview` is the runner's sanitized summary: a value over its per-field
+// cap is not carried whole (older runners wrote an in-band `[N chars]` marker;
+// current ones leave the field out). The body therefore reads the proposed
+// write/edit content from the row's `args` when the caller holds the row, and
+// only that — every other field still renders from the redacted preview.
+// ---------------------------------------------------------------------------
+
+describe("ApprovalCardBody proposed content from args", () => {
+  const BIG = Array.from({ length: 30 }, (_, i) => `gate line ${i + 1}`).join("\n") + "\n";
+
+  function bigWriteApproval(argsPreview: string) {
+    return create(PendingApprovalSchema, {
+      toolCallId: "tc-big",
+      toolName: "write_file",
+      toolKind: ToolKind.FILE_WRITE,
+      argsPreview,
+    });
+  }
+
+  it("renders the whole content from args when the preview carried an elision marker (older runner)", () => {
+    render(
+      <ApprovalCardBody
+        pendingApproval={bigWriteApproval('{"file_path":"/tmp/big.txt","content":"[381 chars]"}')}
+        args={{ file_path: "/tmp/big.txt", content: BIG }}
+        onSubmit={noop}
+      />,
+    );
+
+    expect(screen.getByText("Content")).toBeTruthy();
+    // The head renders, bounded by lines, with the in-place reveal; the marker
+    // is never shown as if it were the file.
+    expect(screen.getByText(/gate line 1\b/)).toBeTruthy();
+    expect(screen.queryByText(/gate line 30/)).toBeNull();
+    expect(screen.getByRole("button", { name: /Show all \d+ lines/ })).toBeTruthy();
+    expect(screen.queryByText(/\[381 chars\]/)).toBeNull();
+    expect(screen.queryByText("New file — preview unavailable")).toBeNull();
+  });
+
+  it("renders the whole content from args when the preview left the field out (current runner)", () => {
+    render(
+      <ApprovalCardBody
+        pendingApproval={bigWriteApproval('{"file_path":"/tmp/big.txt"}')}
+        args={{ file_path: "/tmp/big.txt", content: BIG }}
+        onSubmit={noop}
+      />,
+    );
+
+    expect(screen.getByText("Content")).toBeTruthy();
+    expect(screen.getByText(/gate line 1\b/)).toBeTruthy();
+    expect(screen.queryByText("New file — preview unavailable")).toBeNull();
+  });
+
+  it("without the row, a write whose content the preview left out shows the honest notice", () => {
+    // The row-less surfaces (the workflow approval list, an embedded card):
+    // nothing is invented from a preview that carries no content.
+    render(
+      <ApprovalCardBody
+        pendingApproval={bigWriteApproval('{"file_path":"/tmp/big.txt"}')}
+        onSubmit={noop}
+      />,
+    );
+
+    expect(screen.getByText("New file — preview unavailable")).toBeTruthy();
+    expect(screen.queryByText("Content")).toBeNull();
+  });
+
+  it("overlays the content only — a field the preview redacted stays redacted when args carry it raw", () => {
+    // An MCP gate renders every scalar argument, so this is where a raw value
+    // crossing over from `args` would show. It must not.
+    const approval = create(PendingApprovalSchema, {
+      toolCallId: "tc-mcp-secret",
+      toolName: "publish",
+      toolKind: ToolKind.MCP,
+      mcpServerSlug: "notes",
+      argsPreview: '{"title":"hello","token":"[REDACTED]"}',
+    });
+
+    render(
+      <ApprovalCardBody
+        pendingApproval={approval}
+        args={{ title: "hello", token: "s3cr3t-raw" }}
+        onSubmit={noop}
+      />,
+    );
+
+    expect(screen.getByText("[REDACTED]")).toBeTruthy();
+    expect(screen.queryByText(/s3cr3t-raw/)).toBeNull();
+  });
+
+  it("does not overlay onto a preview the card cannot parse (a record from an older runner's truncation)", () => {
+    // Pre-unification native previews truncated the whole JSON string at 500
+    // chars; such a record's preview does not parse. The body keeps today's
+    // honest notice rather than rendering a content block with no path row.
+    render(
+      <ApprovalCardBody
+        pendingApproval={bigWriteApproval('{"file_path":"/tmp/big.txt","content":"gate li…')}
+        args={{ file_path: "/tmp/big.txt", content: BIG }}
+        onSubmit={noop}
+      />,
+    );
+
+    expect(screen.getByText("New file — preview unavailable")).toBeTruthy();
+    expect(screen.queryByText("Content")).toBeNull();
+  });
+});
+
 describe("ApprovalCard in-card decision error", () => {
   function makeApproval() {
     return create(PendingApprovalSchema, {

package/src/execution/__tests__/ToolCallItem.test.tsx

@@ -494,6 +494,44 @@ describe("ToolCallItem disclosure", () => {
     expect(row.className).not.toContain("stg:bg-warning");
   });
 
+  it("shows a gated write's whole proposed content from the row's args, never the preview's elision marker (stigmer#1107)", () => {
+    // The row holds the authoritative `args`; the approval's `argsPreview` is
+    // the runner's sanitized summary and cannot carry a file of any real size
+    // (an older runner wrote `[N chars]`; the current one leaves the field
+    // out). The inline gate must read the content from the row.
+    const big = Array.from({ length: 30 }, (_, i) => `gate line ${i + 1}`).join("\n") + "\n";
+    const tc = makeToolCall({
+      id: "tc-big-write",
+      name: "write_file",
+      args: { file_path: "/tmp/e2e-big-gate.txt", content: big },
+      status: ToolCallStatus.TOOL_CALL_WAITING_APPROVAL,
+    });
+    const approval: PendingApproval = create(PendingApprovalSchema, {
+      toolCallId: "tc-big-write",
+      toolName: "write_file",
+      argsPreview: '{"file_path":"/tmp/e2e-big-gate.txt","content":"[381 chars]"}',
+    });
+    const ctx: ApprovalContextValue = {
+      approvalsByToolCallId: new Map([["tc-big-write", approval]]),
+      onSubmit: () => {},
+      submittingIds: new Set(),
+      errorsByToolCallId: new Map(),
+    };
+
+    const { container } = render(
+      <ApprovalContext.Provider value={ctx}>
+        <ToolCallItem toolCall={tc} />
+      </ApprovalContext.Provider>,
+    );
+
+    const row = container.querySelector('[data-cursor-target="tool-call-row"]')!;
+    expect(row.textContent).toContain("gate line 1");
+    expect(row.textContent).not.toContain("gate line 30"); // bounded by lines
+    expect(row.textContent).not.toContain("[381 chars]");
+    expect(screen.getByRole("button", { name: /Show all \d+ lines/ })).toBeTruthy();
+    expect(screen.getByLabelText("Approve")).toBeTruthy();
+  });
+
   it("routes an inline APPROVE_ALL decision with the gated tool's id", () => {
     const tc = makeToolCall({
       id: "tc-gated",

package/src/execution/__tests__/write-content.test.ts

@@ -0,0 +1,82 @@
+/**
+ * The one write-content rule for the gate and the settled row (stigmer#1107):
+ * which argument field carries a write's proposed content, and how the gate
+ * overlays that content from the row's authoritative `args` onto the
+ * sanitized preview without letting any other field cross over.
+ */
+import { describe, it, expect } from "vitest";
+import {
+  extractWriteContentFromArgs,
+  parseArgsPreview,
+  withAuthoritativeWriteContent,
+} from "../tool-categories";
+
+describe("extractWriteContentFromArgs", () => {
+  it("returns the first content field holding a non-empty string, in list order", () => {
+    expect(extractWriteContentFromArgs({ contents: "a", content: "b" })).toBe("a");
+    expect(extractWriteContentFromArgs({ content: "", new_string: "b" })).toBe("b");
+    expect(extractWriteContentFromArgs({ new_text: "cursor", replacement: "x" })).toBe("cursor");
+  });
+
+  it("returns null when no content field holds a string", () => {
+    expect(extractWriteContentFromArgs({ file_path: "/x" })).toBeNull();
+    expect(extractWriteContentFromArgs({ content: 42 })).toBeNull();
+    expect(extractWriteContentFromArgs({})).toBeNull();
+  });
+});
+
+describe("parseArgsPreview", () => {
+  it("parses an object preview and rejects everything else", () => {
+    expect(parseArgsPreview('{"path":"/x"}')).toEqual({ path: "/x" });
+    expect(parseArgsPreview("")).toBeNull();
+    expect(parseArgsPreview('"a string"')).toBeNull();
+    expect(parseArgsPreview("[1,2]")).toBeNull();
+    expect(parseArgsPreview('{"path":"/x","content":"trunc…')).toBeNull();
+  });
+});
+
+describe("withAuthoritativeWriteContent", () => {
+  const preview = { file_path: "/x", token: "[REDACTED]", content: "[381 chars]" };
+
+  it("replaces an elided content value under the field args carry it in", () => {
+    const out = withAuthoritativeWriteContent(preview, {
+      file_path: "/x",
+      token: "raw-secret",
+      content: "the whole file\n",
+    });
+    expect(out.content).toBe("the whole file\n");
+  });
+
+  it("adds a content field the preview left out", () => {
+    const out = withAuthoritativeWriteContent(
+      { file_path: "/x" },
+      { file_path: "/x", new_string: "after" },
+    );
+    expect(out).toEqual({ file_path: "/x", new_string: "after" });
+  });
+
+  it("copies nothing but the content: a redacted field stays redacted", () => {
+    const out = withAuthoritativeWriteContent(preview, {
+      file_path: "/y",
+      token: "raw-secret",
+      content: "c",
+      extra: "never shown",
+    });
+    expect(out.token).toBe("[REDACTED]");
+    expect(out.file_path).toBe("/x");
+    expect("extra" in out).toBe(false);
+  });
+
+  it("returns the preview object itself when args carry no content, or are absent", () => {
+    expect(withAuthoritativeWriteContent(preview, { file_path: "/x" })).toBe(preview);
+    expect(withAuthoritativeWriteContent(preview, undefined)).toBe(preview);
+  });
+
+  it("never mutates its inputs", () => {
+    const args = { file_path: "/x", content: "c" };
+    const out = withAuthoritativeWriteContent(preview, args);
+    expect(out).not.toBe(preview);
+    expect(preview.content).toBe("[381 chars]");
+    expect(args.content).toBe("c");
+  });
+});

package/src/execution/tool-categories.ts

@@ -545,6 +545,14 @@ export function extractShellIntentFromPreview(
   }
 }
 
+/**
+ * The argument fields under which a write or edit tool carries the content it
+ * proposes, in the order they are tried. One list for every reader — the
+ * pre-execution gate ({@link ApprovalCardBody}) and the post-execution row
+ * ({@link ToolArgsView}) — so the two never disagree on what "the content" is.
+ * Spans both harnesses' file-tool shapes (deepagents' `content`/`new_string`,
+ * Cursor's `contents`/`new_text`).
+ */
 const WRITE_CONTENT_FIELDS = [
   "contents",
   "content",
@@ -554,29 +562,81 @@ const WRITE_CONTENT_FIELDS = [
   "replacement",
 ] as const;
 
+/** A proposed write's content and the argument field it was found under. */
+interface WriteContent {
+  readonly field: (typeof WRITE_CONTENT_FIELDS)[number];
+  readonly value: string;
+}
+
 /**
- * Extracts the file content body from a JSON `argsPreview` string
- * for write/edit tool categories. Scans the same field names used
- * by the post-execution {@link ToolCallDetail} renderer so that
- * the approval preview matches the completed tool call display.
- *
- * Returns `null` if parsing fails or no content field is found.
+ * Finds the content a write/edit tool proposes in its parsed arguments: the
+ * first {@link WRITE_CONTENT_FIELDS} entry holding a non-empty string, with the
+ * field it sat under. `null` when the args carry no content.
  */
-export function extractWriteContentFromPreview(
-  argsPreview: string,
+function findWriteContent(
+  args: Record<string, unknown>,
+): WriteContent | null {
+  for (const field of WRITE_CONTENT_FIELDS) {
+    const value = args[field];
+    if (typeof value === "string" && value.length > 0) return { field, value };
+  }
+  return null;
+}
+
+/**
+ * The content a write/edit tool proposes, from its parsed arguments, or `null`.
+ * The value half of {@link findWriteContent}.
+ */
+export function extractWriteContentFromArgs(
+  args: Record<string, unknown>,
 ): string | null {
-  if (!argsPreview) return null;
+  return findWriteContent(args)?.value ?? null;
+}
 
+/**
+ * Parses a JSON `argsPreview` string into an args object, or `null` when the
+ * string is empty, unparseable, or not an object. The preview is the runner's
+ * sanitized summary of a tool call's arguments — secrets redacted, a value too
+ * large to carry whole left out, paths and commands kept verbatim — so what
+ * this returns is what a surface may SHOW; the proposed content of a write is
+ * read from the row's `args` (see {@link withAuthoritativeWriteContent}).
+ */
+export function parseArgsPreview(
+  argsPreview: string,
+): Record<string, unknown> | null {
+  if (!argsPreview) return null;
   try {
-    const parsed = JSON.parse(argsPreview);
-    if (typeof parsed !== "object" || parsed === null) return null;
-
-    for (const field of WRITE_CONTENT_FIELDS) {
-      const val = (parsed as Record<string, unknown>)[field];
-      if (typeof val === "string" && val.length > 0) return val;
-    }
-    return null;
+    const parsed: unknown = JSON.parse(argsPreview);
+    return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
   } catch {
     return null;
   }
 }
+
+/**
+ * The preview-parsed args of a gated tool call with the proposed write content
+ * taken from the row's authoritative `args` — and only that.
+ *
+ * A tool row carries two projections of its arguments: `args`, the full
+ * arguments, and `args_preview`, the runner's sanitized summary (secrets
+ * redacted, oversized values left out, paths and commands kept whole). The
+ * summary is the right thing to *show* for every field but one: the content a
+ * write or edit proposes, which is exactly the value the summary cannot carry
+ * and exactly what the user is asked to approve. So the gate renders the
+ * preview's fields and overlays the content from `args`, under the field
+ * `args` carries it in. Nothing else crosses over — a field the runner
+ * redacted in the preview stays redacted here.
+ *
+ * Returns `previewArgs` itself when `args` carries no content (nothing to
+ * overlay) so memoized consumers keep their reference.
+ */
+export function withAuthoritativeWriteContent(
+  previewArgs: Record<string, unknown>,
+  args: Record<string, unknown> | undefined,
+): Record<string, unknown> {
+  const content = args ? findWriteContent(args) : null;
+  if (!content) return previewArgs;
+  return { ...previewArgs, [content.field]: content.value };
+}

package/src/organization/OrgSwitcher.tsx

@@ -54,7 +54,9 @@ export interface OrgSwitcherProps {
  *
  * Designed for sidebar placement — the trigger uses `sidebar-*` design
  * tokens. The portaled dropdown and dialog use standard `popover-*` /
- * main-area tokens per theme-token-guidelines.
+ * main-area tokens, because portaled content renders outside the sidebar's
+ * DOM tree (the theme-token reference in the repository's
+ * sdk-console-architecture skill).
  *
  * Must be rendered inside an {@link OrgProvider}.
  *

package/src/sharing/useCanCreateAgentShare.ts

@@ -34,10 +34,11 @@ export interface UseCanCreateAgentShareReturn {
  *   resource id — an Organization's id equals its slug
  *   (ApiResourceMetadata.id).
  *
- * On the open-source edition both checks reach the server's permissive
- * single-team authorizer and answer allowed — the same posture the
- * backend enforces there (decision 011 D4), so the affordance matches
- * what a create would do.
+ * On the open-source edition the answer follows the server's posture. A
+ * server without sign-in has the permissive single-team authorizer and
+ * answers allowed (decision 011 D4). A server with sign-in enforces the
+ * same organization roles as the cloud, so `can_create_agent_share` is
+ * the admin's and a member sees no share affordance.
  *
  * Pass `null` for `agent` while it loads — `allowed` stays `false` so
  * no affordance flashes before the gate can be evaluated.

package/src/user/UserMenu.tsx

@@ -90,7 +90,9 @@ export interface UserMenuProps {
  *
  * Designed for sidebar placement — the trigger uses `sidebar-*` design
  * tokens. The portaled dropdown uses standard `popover-*` / main-area
- * tokens per theme-token-guidelines (DD-005).
+ * tokens, because portaled content renders outside the sidebar's DOM tree
+ * (the theme-token reference in the repository's sdk-console-architecture
+ * skill).
  *
  * Framework-agnostic: all actions are expressed as callback props
  * (DD-004). The consumer bridges to their routing, auth, and theme