@stigmer/react 3.40.1 → 3.41.0

package/src/provider.tsx

@@ -15,6 +15,7 @@ import { StigmerContext } from "./context.js";
 import { DeploymentModeContext } from "./deployment-mode.js";
 import { ExecutionTargetContext } from "./execution-target-context.js";
 import { ApprovalDefaultsContext } from "./approval-defaults-context.js";
+import { PublicBaseUrlContext } from "./public-base-url-context.js";
 import type { ApprovalDefaults } from "./approval-defaults-context.js";
 import type { ExecutionTargetOption } from "./session/execution-target.js";
 import type { RunnerAdapter } from "./runner-adapter.js";
@@ -121,6 +122,32 @@ export interface StigmerProviderProps {
    * ```
    */
   readonly approvalDefaults?: ApprovalDefaults;
+  /**
+   * The address the Stigmer API is reached at from outside this page, for
+   * the URLs the SDK shows a user to copy (the Slack and WhatsApp webhook
+   * URLs a channel app registers, and the platform client snippet in the
+   * Share dialog). A session's MCP servers get their
+   * `STIGMER_SERVER_ADDRESS` from the platform, never from this value.
+   *
+   * Omit it when the client's `baseUrl` is absolute: that address is used,
+   * exactly as before. Pass it when the client talks to the server through
+   * a relative `baseUrl` (a same-origin proxy), because the page's own
+   * origin need not be where Slack, Meta, a backend or a remote MCP server
+   * can reach the API. Without it, the copy surfaces say they do not know
+   * the server's public address and offer nothing to copy. Only an
+   * absolute `http(s)` URL is used.
+   *
+   * @example
+   * ```tsx
+   * // The browser reaches the API through the page's own origin
+   * const client = new Stigmer({ baseUrl: "/", getAccessToken });
+   *
+   * <StigmerProvider client={client} publicBaseUrl="https://api.example.com">
+   *   <App />
+   * </StigmerProvider>
+   * ```
+   */
+  readonly publicBaseUrl?: string;
   /**
    * Built-in theme preset to apply.
    *
@@ -288,6 +315,7 @@ export function StigmerProvider({
   executionTarget,
   runnerAdapter,
   approvalDefaults,
+  publicBaseUrl,
   preset,
   className,
   colorMode = "light",
@@ -310,32 +338,34 @@ export function StigmerProvider({
         <ExecutionTargetContext.Provider value={executionTarget}>
           <ApprovalDefaultsContext.Provider value={approvalDefaults}>
             <RunnerAdapterContext.Provider value={runnerAdapter ?? null}>
-              <ColorModeContext.Provider value={resolvedMode}>
-                <ModelRegistryContext.Provider value={registryState}>
-                  <TaskKindRegistryContext.Provider value={taskKindRegistryState}>
-                    <ReviewRendererContext.Provider value={reviewRenderers ?? EMPTY_REVIEW_RENDERERS}>
-                      <PortalContainerContext.Provider value={portalContainer}>
-                        {/*
-                          The in-tree scoping container. `data-stgm-root` is a
-                          stable public selector — the documented seam for hosts
-                          to style THIS element only (e.g. the fixed-height
-                          embedding recipe, #260). It must never be mirrored
-                          onto the portal container, whose own `data-stgm-portal`
-                          marker keeps host in-tree-only CSS away from the
-                          off-tree element.
-                        */}
-                        <div
-                          className={scope.className}
-                          data-stgm-root=""
-                          data-stgm-color-mode={scope.colorMode}
-                        >
-                          {children}
-                        </div>
-                      </PortalContainerContext.Provider>
-                    </ReviewRendererContext.Provider>
-                  </TaskKindRegistryContext.Provider>
-                </ModelRegistryContext.Provider>
-              </ColorModeContext.Provider>
+              <PublicBaseUrlContext.Provider value={publicBaseUrl}>
+                <ColorModeContext.Provider value={resolvedMode}>
+                  <ModelRegistryContext.Provider value={registryState}>
+                    <TaskKindRegistryContext.Provider value={taskKindRegistryState}>
+                      <ReviewRendererContext.Provider value={reviewRenderers ?? EMPTY_REVIEW_RENDERERS}>
+                        <PortalContainerContext.Provider value={portalContainer}>
+                          {/*
+                            The in-tree scoping container. `data-stgm-root` is a
+                            stable public selector — the documented seam for hosts
+                            to style THIS element only (e.g. the fixed-height
+                            embedding recipe, #260). It must never be mirrored
+                            onto the portal container, whose own `data-stgm-portal`
+                            marker keeps host in-tree-only CSS away from the
+                            off-tree element.
+                          */}
+                          <div
+                            className={scope.className}
+                            data-stgm-root=""
+                            data-stgm-color-mode={scope.colorMode}
+                          >
+                            {children}
+                          </div>
+                        </PortalContainerContext.Provider>
+                      </ReviewRendererContext.Provider>
+                    </TaskKindRegistryContext.Provider>
+                  </ModelRegistryContext.Provider>
+                </ColorModeContext.Provider>
+              </PublicBaseUrlContext.Provider>
             </RunnerAdapterContext.Provider>
           </ApprovalDefaultsContext.Provider>
         </ExecutionTargetContext.Provider>

package/src/public-base-url-context.ts

@@ -0,0 +1,70 @@
+"use client";
+
+import { createContext, useContext } from "react";
+import { useStigmer } from "./hooks.js";
+
+/**
+ * React context for the server's public base URL: the address the Stigmer
+ * API is reached at from outside the page, supplied by the host through
+ * `StigmerProvider`'s `publicBaseUrl`.
+ *
+ * Separated from the provider to mirror the `ExecutionTargetContext`
+ * pattern and avoid circular imports.
+ *
+ * `undefined` means the host named no public address; the client's own
+ * `baseUrl` then stands in when it is absolute.
+ */
+export const PublicBaseUrlContext = createContext<string | undefined>(
+  undefined,
+);
+
+/**
+ * The server's public base URL for URLs the SDK shows a user to copy (a
+ * webhook URL pasted into Slack or Meta, a platform client snippet run by
+ * a backend), or `null` when it cannot be known.
+ *
+ * The host owns public addresses, and the SDK never guesses one (the
+ * `buildShareUrl` precedent in `ShareAgentDialog`): the provider's
+ * `publicBaseUrl` wins, the client's `baseUrl` stands in for it, and only
+ * an absolute `http(s)` URL counts. A relative `baseUrl` (a same-origin
+ * proxy, the documentation tours) with no `publicBaseUrl` answers `null`,
+ * because the page's own origin need not be where the API is reached from
+ * outside; the surface then says the address is unknown instead of offering
+ * one nobody can call. A `publicBaseUrl` that is not absolute is a host
+ * mistake and counts for nothing. Trailing slashes are trimmed.
+ */
+export function usePublicBaseUrl(): string | null {
+  const hostPublicBaseUrl = useContext(PublicBaseUrlContext);
+  const { baseUrl } = useStigmer();
+  return resolvePublicBaseUrl(hostPublicBaseUrl, baseUrl);
+}
+
+/**
+ * The pure rule behind {@link usePublicBaseUrl}: the first of the host's
+ * public base URL and the client's base URL that is an absolute `http(s)` URL,
+ * trailing slashes trimmed, or `null` when neither is.
+ */
+export function resolvePublicBaseUrl(
+  hostPublicBaseUrl: string | undefined,
+  clientBaseUrl: string,
+): string | null {
+  for (const candidate of [hostPublicBaseUrl, clientBaseUrl]) {
+    if (candidate !== undefined && isAbsoluteUrl(candidate)) {
+      return candidate.replace(/\/+$/, "");
+    }
+  }
+  return null;
+}
+
+/**
+ * Whether `value` is an absolute `http(s)` URL. The protocol check matters:
+ * `new URL("localhost:7234")` parses, with `localhost:` as its scheme.
+ */
+function isAbsoluteUrl(value: string): boolean {
+  try {
+    const { protocol } = new URL(value);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}

package/src/resource-workbench/components/SelectionCheckbox.tsx

@@ -43,7 +43,7 @@ export function SelectionCheckbox({
       onChange={(e) => onChange(e.target.checked)}
       aria-label={ariaLabel}
       className={cn(
-        "stg:size-3.5 stg:shrink-0 stg:cursor-pointer stg:rounded stg:border stg:border-input stg:accent-primary",
+        "stg:size-3.5 stg:shrink-0 stg:cursor-pointer stg:rounded stg:border stg:border-input",
         "stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring stg:focus-visible:ring-offset-1",
         className,
       )}

package/src/session/useLocalSessionWorker.ts

@@ -3,6 +3,7 @@
 import { useEffect, useMemo } from "react";
 import type { Session } from "@stigmer/protos/ai/stigmer/agentic/session/v1/api_pb";
 import { ExecutionTarget } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
+import { useWhoAmI } from "../iam-policy/useWhoAmI.js";
 import { useRunnerAdapter } from "../runner-adapter.js";
 import { useExecutionTarget } from "../execution-target-context.js";
 import { fromProtoExecutionTarget } from "./execution-target.js";
@@ -25,12 +26,28 @@ import { fromProtoExecutionTarget } from "./execution-target.js";
  * free. It is a no-op unless a `runnerAdapter` is configured **and** the
  * session resolves to local execution (cloud sessions are server-provisioned).
  *
- * The effect depends only on stable primitives (`adapter`, `sessionId`, and
- * the derived `effectiveTarget` string) and **never on the `session` object**.
+ * **Only the session's own person serves it.** Anyone a session is shared
+ * with can open it, and every desktop that attached would poll the same
+ * queue, each turn going to whichever worker asks first. A server with
+ * sign-in credentials a local session's runner for the person who created
+ * the session, so another viewer's desktop would take turns it cannot run
+ * (or, where it could, run someone else's turn on its own machine). The
+ * worker is therefore kept off exactly when the signed-in account is known
+ * and is not the session's creator — the creator stamp read the two ways
+ * the server reads it, as the account id and as the account's identity
+ * provider subject. Every other case attaches as before: while the account
+ * is loading the attach waits (as it waits for the session), and when there
+ * is no account (a single-user server answers `whoAmI` NOT_FOUND, and every
+ * session there is its operator's) the desktop serves the session.
+ *
+ * The effect depends only on stable primitives (`adapter`, `sessionId`, the
+ * derived `effectiveTarget` string and the derived `servesHere` flag) and
+ * **never on the `session` object**.
  * `useSessionConversation` refetches the session frequently; keying the effect
  * on the object would tear down and restart the worker on every refetch
  * (DD-010 / reference-stability). `executionTarget` is immutable after the
- * first execution, so the derived string stays stable across refetches.
+ * first execution, and a session's creator never changes, so both derived
+ * values stay stable across refetches.
  *
  * @param sessionId - The session being viewed, or `null` to skip.
  * @param session - The loaded session, or `null` while loading. The worker is
@@ -43,6 +60,7 @@ export function useLocalSessionWorker(
 ): void {
   const adapter = useRunnerAdapter();
   const contextTarget = useExecutionTarget();
+  const { account, isLoading: accountLoading } = useWhoAmI();
 
   // Resolve the session's effective execution target as a stable primitive.
   // `undefined` until the session loads — so we never attach a local worker
@@ -59,8 +77,21 @@ export function useLocalSessionWorker(
     );
   }, [isLoaded, specTarget, contextTarget]);
 
+  // Whether this viewer's desktop may serve the session, as a stable
+  // primitive: `undefined` while the account is loading, `true` when there
+  // is no account to compare or the account is the session's creator.
+  const creatorStamp = session?.status?.audit?.specAudit?.createdBy?.id ?? "";
+  const accountId = account?.metadata?.id ?? "";
+  const accountSubject = account?.spec?.idpId ?? "";
+  const servesHere = useMemo(() => {
+    if (accountLoading) return undefined;
+    if (accountId === "" || creatorStamp === "") return true;
+    return creatorStamp === accountId || creatorStamp === accountSubject;
+  }, [accountLoading, accountId, accountSubject, creatorStamp]);
+
   useEffect(() => {
     if (!adapter || !sessionId || effectiveTarget !== "local") return;
+    if (servesHere !== true) return;
 
     // Fire-and-forget: a runner-start failure must not crash the session view.
     // The host adapter's add/remove are idempotent, so React's cleanup-driven
@@ -69,5 +100,5 @@ export function useLocalSessionWorker(
     return () => {
       adapter.onSessionClosed(sessionId).catch(() => {});
     };
-  }, [adapter, sessionId, effectiveTarget]);
+  }, [adapter, sessionId, effectiveTarget, servesHere]);
 }

package/src/settings/ChannelAppsSection.tsx

@@ -41,10 +41,10 @@ type FlowState =
  *
  * "New channel app" is offered once the server confirms the caller holds
  * `can_create_channel_app` on the organization. The list shows only the
- * apps the caller may view (their creator, anyone granted viewer on one,
- * and the organization's admins), so a caller who may not create channel
- * apps is told that the organization's admins manage them rather than that
- * none is registered.
+ * apps the caller may view (the organization's admins, and anyone granted
+ * viewer on an app), so a caller who may not create channel apps is told
+ * that the organization's admins manage them rather than that none is
+ * registered.
  */
 export function ChannelAppsSection() {
   const headingId = useId();

package/src/settings/ProviderKeysSection.tsx

@@ -0,0 +1,4 @@
+"use client";
+
+export { ProviderKeysSection } from "../billing/ProviderKeysSection.js";
+export type { ProviderKeysSectionProps } from "../billing/ProviderKeysSection.js";

package/src/settings/index.ts

@@ -22,3 +22,5 @@ export { TeamsSection } from "./TeamsSection.js";
 export { OAuthAppsSection } from "./OAuthAppsSection.js";
 export { ChannelAppsSection } from "./ChannelAppsSection.js";
 export { UsageSection } from "./UsageSection.js";
+export { ProviderKeysSection } from "./ProviderKeysSection.js";
+export type { ProviderKeysSectionProps } from "./ProviderKeysSection.js";

package/src/settings/settings-nav.ts

@@ -10,6 +10,7 @@ import {
   FileBadge,
   Layers,
   KeyRound,
+  KeySquare,
   Link,
   MessageSquare,
   MousePointerClick,
@@ -102,6 +103,7 @@ export const SETTINGS_NAV_GROUPS: readonly SettingsNavGroup[] = [
     items: [
       { href: "/settings/billing", label: "Billing", icon: CreditCard },
       { href: "/settings/usage", label: "Usage", icon: BarChart3 },
+      { href: "/settings/provider-keys", label: "Provider keys", icon: KeySquare },
     ],
   },
   {

package/src/sharing/ShareAgentDialog.tsx

@@ -23,7 +23,8 @@ import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/ap
 import { Switch } from "../switch/Switch.js";
 import { Tabs, type TabItem } from "../tabs/Tabs.js";
 import { toast } from "../feedback/toast.js";
-import { useStigmer } from "../hooks.js";
+import { usePublicBaseUrl } from "../public-base-url-context.js";
+import { UnknownPublicAddressNotice } from "../internal/UnknownPublicAddressNotice.js";
 import { useCopyResource } from "../resource-detail/useCopyResource.js";
 import { useDeploymentMode } from "../deployment-mode.js";
 import { useBillingAccount } from "../billing/useBillingAccount.js";
@@ -1510,10 +1511,10 @@ function MessageField({
 
 /**
  * The platform client snippet, aimed at the server the console is connected
- * to (`stigmer.baseUrl`) — a self-hosted admin copies code for their own
- * server, not Stigmer Cloud. The base URL is normalised as the channel-app
- * webhook URLs normalise it, and JSON-quoted so the line is always a valid
- * string literal.
+ * to — a self-hosted admin copies code for their own server, not Stigmer
+ * Cloud. `apiBaseUrl` is the server's public base URL (`usePublicBaseUrl`),
+ * the address the channel-app webhook URLs are built from too, JSON-quoted
+ * so the line is always a valid string literal.
  */
 function buildDeveloperSnippet(
   apiBaseUrl: string,
@@ -1544,10 +1545,14 @@ function DeveloperTab({
   readonly org: string;
   readonly slug: string;
 }) {
-  const stigmer = useStigmer();
+  const publicBaseUrl = usePublicBaseUrl();
+  // `null` while the server's public address is unknown: the field says so.
   const snippet = useMemo(
-    () => buildDeveloperSnippet(stigmer.baseUrl, org, slug),
-    [stigmer.baseUrl, org, slug],
+    () =>
+      publicBaseUrl === null
+        ? null
+        : buildDeveloperSnippet(publicBaseUrl, org, slug),
+    [publicBaseUrl, org, slug],
   );
 
   return (
@@ -1557,12 +1562,23 @@ function DeveloperTab({
         integrate this agent with the Stigmer SDK — the same runtime, full
         control.
       </p>
-      <CopyField
-        label="Platform client integration"
-        value={snippet}
-        copyLabel="Code"
-        multiline
-      />
+      {snippet !== null ? (
+        <CopyField
+          label="Platform client integration"
+          value={snippet}
+          copyLabel="Code"
+          multiline
+        />
+      ) : (
+        <section>
+          <h3 className="stg:text-xs stg:font-medium stg:text-muted-foreground">
+            Platform client integration
+          </h3>
+          <div className="stg:mt-1.5">
+            <UnknownPublicAddressNotice subject="the integration code" />
+          </div>
+        </section>
+      )}
       <a
         href={PLATFORM_CLIENT_DOCS_URL}
         target="_blank"

package/src/sharing/useCanCreateAgentShare.ts

@@ -18,7 +18,9 @@ export interface UseCanCreateAgentShareReturn {
  * installed copy), and creating one asks two questions of that
  * organization, both of which the create handler enforces:
  *
- * - `can_edit` on the agent — the share is a channel to this agent.
+ * - `can_manage_audience` on the agent — a share puts the agent in front of a
+ *   wider audience, so it is the owner's decision; an editor, who may change
+ *   the definition, may not publish it.
  * - `can_create_agent_share` on the organization (admin by default) — a
  *   share spends the organization's credits with anyone on the internet,
  *   so it is an admin-level decision. The org check uses the org slug as
@@ -46,14 +48,14 @@ export function useCanCreateAgentShare(
   const agentId = agent?.metadata?.id ?? "";
   const agentOrg = agent?.metadata?.org ?? "";
 
-  const { allowed: canEditAgent } = useCheckPermission(
+  const { allowed: canPublishAgent } = useCheckPermission(
     agentId ? { kind: "agent", id: agentId } : null,
-    "can_edit",
+    "can_manage_audience",
   );
   const { allowed: canCreateInOrg } = useCheckPermission(
     agentOrg ? { kind: "organization", id: agentOrg } : null,
     "can_create_agent_share",
   );
 
-  return { allowed: !!agent && canEditAgent && canCreateInOrg };
+  return { allowed: !!agent && canPublishAgent && canCreateInOrg };
 }

package/src/sharing/useSaveAgentShare.ts

@@ -162,7 +162,7 @@ export interface UseSaveAgentShareReturn {
  *
  * Commits via `stigmer.agentShare.apply()` — an idempotent upsert keyed
  * on the share's `(org, slug)` identity — so one code path serves both
- * creation (the server authorizes on the referenced agent's `can_edit`
+ * creation (the server authorizes on the referenced agent's `can_manage_audience`
  * and the organization's `can_create_agent_share`) and every later
  * edit. There is deliberately no create/update
  * branching: the share slug is unique per org, which makes

package/src/styles.css

@@ -28,10 +28,11 @@
    self-referential `--stgm-font-sans: var(--stgm-font-sans)` cycle through
    the `@theme inline` block below).
 
-   The `stg:` prefix contract is enforced by `scripts/check-prefixed-classnames`
-   (unprefixed utilities in source fail the suite) and by the dist isolation
-   invariant test (unscoped selectors in the built stylesheet fail the suite).
-   The one-shot migration lives in `scripts/prefix-classnames.ts`. */
+   The `stg:` prefix contract is enforced by `scripts/prefix-classnames.ts
+   --check` (`npm run lint:prefix`: an unprefixed utility, or a prefix placed
+   after a variant, fails the lint) and by the dist isolation invariant test
+   (unscoped selectors in the built stylesheet fail the suite). The same
+   script, without `--check`, is the one-shot migration. */
 @import "tailwindcss/theme.css" layer(stgm) prefix(stg);
 @import "tailwindcss/utilities.css" layer(stgm) prefix(stg);
 /* Enter/exit animation utilities (`stg:animate-in`, `stg:fade-in`,
@@ -294,6 +295,15 @@
     color-scheme: dark;
   }
 
+  /* The same holds for a checkbox's or radio's checked state: the browser
+     paints it from `accent-color` (its own blue by default), never from our
+     tokens (#1228). One inherited rule on both containers gives every native
+     control inside the scope the theme's primary, in both modes and every
+     preset, so no control needs its own accent class. */
+  .stgm {
+    accent-color: var(--stgm-primary);
+  }
+
   /* The provider's in-tree container ([data-stgm-root]) ships with NO
      layout styling — deliberately (#260, DD-019). A default
      `height: 100%` looks benign ("resolves to auto under auto-height

package/src/workflow/WorkflowTaskApprovalSummary.tsx

@@ -31,10 +31,13 @@ export interface WorkflowTaskApprovalSummaryProps {
    */
   readonly outcomes: readonly TaskOutcome[];
   /**
-   * The recorded decision, sourced from the canonical task output. When
-   * `null` — or when its `outcome` is still empty — the gate has been
-   * resolved but the decision record has not yet materialized in the
-   * status snapshot; a "finalizing" affordance is shown instead.
+   * The recorded decision, sourced from the canonical task output with the
+   * `approval_resolved` event standing in until the status snapshot
+   * catches up. When `null` — or when its `outcome` is still empty — the
+   * gate has been resolved but neither source carries the decision yet; a
+   * "finalizing" affordance is shown instead. The one exception is an
+   * auto-resolved decision with an empty outcome: the gate timed out under
+   * the fail policy and ended without a decision, which is final.
    */
   readonly decision: TaskDetailApprovalDecision | null;
   /** Additional CSS class names for the root container. */
@@ -73,13 +76,17 @@ export const WorkflowTaskApprovalSummary = memo(function WorkflowTaskApprovalSum
   decision,
   className,
 }: WorkflowTaskApprovalSummaryProps) {
-  const isFinalizing = !decision || decision.outcome === "";
+  // A fail-policy timeout ends the gate with no outcome; that is the record,
+  // not a decision still on its way.
+  const timedOutUndecided = decision !== null && decision.autoResolved && decision.outcome === "";
+  const isFinalizing = !decision || (decision.outcome === "" && !timedOutUndecided);
 
   const outcomeLabel = useMemo(() => {
+    if (timedOutUndecided) return "Timed out — no decision";
     if (!decision || !decision.outcome) return "";
     const match = outcomes.find((o) => o.name === decision.outcome);
     return match?.label || capitalize(decision.outcome.replace(/_/g, " "));
-  }, [decision, outcomes]);
+  }, [decision, outcomes, timedOutUndecided]);
 
   const tone: DecisionTone = useMemo(
     () => (decision && !isFinalizing ? resolveTone(decision.outcome) : "neutral"),
@@ -116,7 +123,7 @@ export const WorkflowTaskApprovalSummary = memo(function WorkflowTaskApprovalSum
             <ToneIcon tone={tone} />
             {outcomeLabel}
           </span>
-          {decision!.autoResolved && (
+          {decision!.autoResolved && !timedOutUndecided && (
             <span className="stg:rounded stg:bg-muted stg:px-1.5 stg:py-0.5 stg:text-[10px] stg:font-medium stg:text-muted-foreground">
               auto-resolved
             </span>

package/src/workflow/inspector/tabs/BranchesTab.tsx

@@ -295,7 +295,7 @@ function ForkBranches({
               name={`join-policy-${node.id}`}
               checked={!compete}
               onChange={() => handleSetCompete(false)}
-              className="stg:h-3 stg:w-3 stg:accent-[var(--stgm-primary,#6366f1)]"
+              className="stg:h-3 stg:w-3"
             />
             Wait for all branches
           </label>
@@ -305,7 +305,7 @@ function ForkBranches({
               name={`join-policy-${node.id}`}
               checked={compete}
               onChange={() => handleSetCompete(true)}
-              className="stg:h-3 stg:w-3 stg:accent-[var(--stgm-primary,#6366f1)]"
+              className="stg:h-3 stg:w-3"
             />
             Race mode (first branch wins)
           </label>

package/src/workflow/inspector/tabs/CatchTab.tsx

@@ -135,7 +135,7 @@ export const CatchTab = memo(function CatchTab({ node, mutations }: CatchTabProp
                 type="checkbox"
                 checked={catchBlock.compensate}
                 onChange={handleCompensateToggle}
-                className="stg:h-3 stg:w-3 stg:accent-[var(--stgm-primary,#6366f1)]"
+                className="stg:h-3 stg:w-3"
               />
               Run compensation before catch block
             </label>

package/src/workflow/inspector/tabs/IterationTab.tsx

@@ -194,7 +194,7 @@ export const IterationTab = memo(function IterationTab({
                   value={opt.value}
                   checked={onError === opt.value}
                   onChange={() => handleErrorPolicyChange(opt.value)}
-                  className="stg:mt-0.5 stg:h-3 stg:w-3 stg:accent-[var(--stgm-primary,#6366f1)]"
+                  className="stg:mt-0.5 stg:h-3 stg:w-3"
                 />
                 <span>
                   <span className="stg:font-medium">{opt.label}</span>

package/src/workflow/instance/WorkflowInstanceDetailPanel.tsx

@@ -68,15 +68,16 @@ export function WorkflowInstanceDetailPanel({
   const visibility = meta?.visibility ?? ApiResourceVisibility.visibility_private;
   // Run observability is a separate axis from instance visibility, and only
   // meaningful while the instance is private (ORG/PUBLIC already expose runs
-  // by inheritance). It is offered only to those who can grant access, so it
-  // rides into the dialog as the resource-specific section — present only when
-  // both conditions hold.
-  const { allowed: canGrantAccess } = useCheckPermission(
+  // by inheritance). It is offered only to those who may change who reaches
+  // the instance (can_manage_audience, the server's bar on
+  // updateExecutionVisibility), so it rides into the dialog as the
+  // resource-specific section — present only when both conditions hold.
+  const { allowed: canManageAudience } = useCheckPermission(
     id ? { kind: "workflow_instance", id } : null,
-    "can_grant_access",
+    "can_manage_audience",
   );
   const runVisibilitySection =
-    visibility === ApiResourceVisibility.visibility_private && canGrantAccess
+    visibility === ApiResourceVisibility.visibility_private && canManageAudience
       ? {
           title: "Run visibility",
           description:

package/src/workflow/task-detail/task-approval.ts

@@ -50,15 +50,6 @@ export interface TaskApprovalRequestView {
   readonly payloadArtifactId: string | null;
 }
 
-/**
- * A resolved human_input decision, sourced from the canonical task-output
- * record (the runner stores the reviewer's full response as the task
- * output) and enriched with timing from the `approval_resolved` event.
- *
- * `outcome` is the empty string during the brief window after a decision
- * is signalled but before the status snapshot reflects the task output —
- * consumers render a "finalizing" affordance in that state.
- */
 /**
  * Display identity of the reviewer, snapshotted server-side at decision
  * time (see `reviewer_actor` in the human_input task-output contract).
@@ -95,6 +86,17 @@ export interface TaskReviewerView {
   readonly isRawId: boolean;
 }
 
+/**
+ * A resolved human_input decision, sourced from the canonical task-output
+ * record (the runner stores the reviewer's full response as the task
+ * output), with the `approval_resolved` event standing in for any field the
+ * status snapshot has not captured yet and supplying the wait duration.
+ *
+ * `outcome` is the empty string only when neither source carries it: in
+ * the brief window before the status snapshot reflects the task output,
+ * for an event recorded before the payload had an `outcome` field.
+ * Consumers render a "finalizing" affordance in that state.
+ */
 export interface TaskDetailApprovalDecision {
   /** Chosen outcome identifier (e.g. "approve", "pause_campaigns"). */
   readonly outcome: string;
@@ -166,7 +168,7 @@ export function deriveTaskApprovalDecision(
   if (resolution === null && outputOutcome === "") return null;
 
   return {
-    outcome: outputOutcome,
+    outcome: outputOutcome || (resolution?.outcome ?? ""),
     reviewer:
       readSnapshotString(taskOutput, "reviewer") || (resolution?.resolvedBy ?? ""),
     reviewerActor: deriveReviewerActor(resolution, taskOutput),
@@ -175,15 +177,20 @@ export function deriveTaskApprovalDecision(
       readSnapshotString(taskOutput, "comment") || (resolution?.comment ?? ""),
     formData: readSnapshotObject(taskOutput, "form_data"),
     waitDurationMs: resolution ? Number(resolution.waitDurationMs) : 0,
-    autoResolved: taskOutput?.["auto_resolved"] === true,
+    // Output first, like every field above: once the snapshot carries the
+    // decision it is the record, and the event only fills the window before.
+    autoResolved:
+      outputOutcome !== ""
+        ? taskOutput?.["auto_resolved"] === true
+        : resolution?.autoResolved === true,
   };
 }
 
 /**
  * Collapses a decision's attribution into the render-ready reviewer view,
  * or `null` when the decision carries no attribution at all (timeout
- * auto-resolution, OSS single-user edition) — consumers omit the "by …"
- * segment entirely in that case.
+ * auto-resolution) — consumers omit the "by …" segment entirely in that
+ * case.
  */
 export function deriveTaskReviewer(
   decision: TaskDetailApprovalDecision,