cohvu 2.16.0 → 2.17.0

package/dist/tui/App.js

@@ -3,7 +3,7 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 // Direct translation of dashboard.ts into React hooks.
 import { useReducer, useRef, useEffect, useCallback } from 'react';
 import { Box, Text, useInput, useApp, useStdout } from 'ink';
-import { reduce, initialState, TABS, getActiveProject, getActiveTeam } from './state.js';
+import { reduce, initialState, TABS, getActiveProject, getActiveTeam, isTeamLocked, filterToSameEntity } from './state.js';
 import { ApiClient } from '../api.js';
 import { runSetup } from '../setup.js';
 import { detectPlatformStatuses } from './platform-detect.js';
@@ -20,7 +20,7 @@ import { BillingTab } from './tabs/BillingTab.js';
 import { ProjectTab } from './tabs/ProjectTab.js';
 import { KeysTab } from './tabs/KeysTab.js';
 import { YouTab } from './tabs/YouTab.js';
-import { KNOWN_TOOL_NAMES } from './state.js';
+import { ALL_KEY_ACTIONS } from './state.js';
 import { timeUntil } from './utils.js';
 import { exec, execFile } from 'child_process';
 import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync, watch } from 'fs';
@@ -76,12 +76,6 @@ export default function App() {
             execFile(cmd, [url], () => { });
         }
     }
-    function shouldRequireConsensus(s) {
-        if (!s.requireConsensus)
-            return false;
-        const admins = s.members.filter(m => m.role === 'admin');
-        return admins.length >= 2;
-    }
     function copyToClipboard(text) {
         const cmd = process.platform === 'darwin' ? 'pbcopy'
             : process.platform === 'win32' ? 'clip' : 'xclip -selection clipboard';
@@ -278,6 +272,23 @@ export default function App() {
             }
             catch { }
         }, 30_000);
+        // Team overview powers the lock card when a team sub is canceled. It's
+        // cheap and always reflects the current team's shape — fetch on every
+        // project switch into a team project, clear when switching to personal.
+        const project = stateRef.current.projects.find(p => p.project_id === projectId);
+        if (project?.owner.kind === 'team') {
+            const teamId = project.owner.teamId;
+            api.getTeamOverview(teamId)
+                .then(overview => {
+                if (stateRef.current.activeProjectId === projectId) {
+                    dispatch({ type: 'SET_TEAM_OVERVIEW', overview });
+                }
+            })
+                .catch(() => { });
+        }
+        else {
+            dispatch({ type: 'SET_TEAM_OVERVIEW', overview: null });
+        }
         setTimeout(() => loadTabData(), 0);
     }, [api, connectFeed, dispatch, loadTabData]);
     const executeSearch = useCallback(async () => {
@@ -482,6 +493,43 @@ export default function App() {
             await handleModalKey(input, key);
             return;
         }
+        // Team sub canceled — admins can hit `r` from any team tab to start
+        // resubscribe checkout. Members just see the contact list in the lock
+        // card; `r` does nothing for them.
+        if (isTeamLocked(s) && input === 'r' && s.userRole === 'admin') {
+            const team = getActiveTeam(s);
+            if (team) {
+                try {
+                    showToast('Opening checkout...', 'info');
+                    const c = await api.createTeamCheckout(team.team_id);
+                    if (c.checkout_url)
+                        openBrowser(c.checkout_url);
+                }
+                catch {
+                    showToast('Failed to open checkout', 'error');
+                }
+            }
+            return;
+        }
+        // Pro canceled with locked personal project in view — `u` opens Pro
+        // checkout. One checkout unlocks every personal project at once, no
+        // per-project choice. Integration keys stay disabled and need manual
+        // restore after.
+        if (input === 'u' && !s.modal) {
+            const project = getActiveProject(s);
+            if (project?.owner.kind === 'personal' && project.locked) {
+                try {
+                    showToast('Opening checkout...', 'info');
+                    const c = await api.createIndividualCheckout();
+                    if (c.checkout_url)
+                        openBrowser(c.checkout_url);
+                }
+                catch {
+                    showToast('Failed to open checkout', 'error');
+                }
+                return;
+            }
+        }
         // Approval keys (when approvals exist, on team/project tab, team project)
         if ((input === 'a' || input === 'x') && !s.modal && s.pendingApprovals.length > 0 && (s.tab === 'team' || s.tab === 'project')) {
             const activeProject = getActiveProject(s);
@@ -492,7 +540,7 @@ export default function App() {
                             kind: 'approve-action',
                             approvalId: approval.id,
                             description: approval.description,
-                            initiator: approval.initiator_email,
+                            initiator: approval.initiator_email ?? approval.initiator_name ?? 'unknown',
                             expiresIn: timeUntil(approval.expires_at),
                         } });
                 }
@@ -567,21 +615,22 @@ export default function App() {
         }
         if (input === 'n' && s.userRole === 'admin') {
             if (!hasPaidPlan(s)) {
-                showToast('Integration keys require a paid plan', 'error');
+                showToast('Keys require a paid plan', 'error');
                 return;
             }
-            const adminProjects = adminScopableProjects(s);
             dispatch({ type: 'OPEN_MODAL', modal: {
                     kind: 'create-integration-key',
                     step: 'name',
                     input: '',
-                    projectId: adminProjects[0]?.project_id ?? '',
-                    projectSelectedIdx: 0,
-                    role: 'member',
-                    roleSelectedIdx: 1,
-                    allowedTools: [],
-                    toolsSelectedIdx: 0,
                     agentName: '',
+                    projectSelectedIdx: 0,
+                    selectedProjectIds: new Set(),
+                    projectScopes: new Map(),
+                    permProjectIdx: 0,
+                    permActionIdx: 0,
+                    limitsField: 'expiry',
+                    expiresInDays: '',
+                    opsLimit: '',
                 } });
             return;
         }
@@ -592,6 +641,37 @@ export default function App() {
             }
             return;
         }
+        // Restore a disabled integration key. Only valid when the selected key
+        // is disabled — otherwise `r` is a no-op here. Server rotates the
+        // secret and returns it once; TUI shows the "new secret" modal so the
+        // admin can copy it into their external systems.
+        if (input === 'r' && s.userRole === 'admin' && s.apiKeys.length > 0) {
+            const target = s.apiKeys[s.apiKeysSelected];
+            if (target && target.disabled_at) {
+                try {
+                    dispatch({ type: 'SET_OPERATION', operation: 'Restoring key' });
+                    const { api_key, key } = await api.restoreApiKey(target.id);
+                    dispatch({ type: 'SET_OPERATION', operation: null });
+                    dispatch({ type: 'OPEN_MODAL', modal: {
+                            kind: 'key-created',
+                            keyId: api_key.id,
+                            keyValue: key,
+                            keyName: api_key.name,
+                            kind2: 'integration',
+                        } });
+                    // Refresh the list so the restored key moves out of the disabled section.
+                    if (s.activeProjectId) {
+                        const keys = await api.listIntegrationKeys(s.activeProjectId);
+                        dispatch({ type: 'SET_API_KEYS', keys });
+                    }
+                }
+                catch {
+                    dispatch({ type: 'SET_OPERATION', operation: null });
+                    showToast('Failed to restore key', 'error');
+                }
+            }
+            return;
+        }
     }
     // ---- Knowledge keys ----
     async function handleKnowledgeKey(input, key) {
@@ -746,10 +826,22 @@ export default function App() {
             dispatch({ type: 'OPEN_MODAL', modal: { kind: 'confirm-rename-team', input: '' } });
             return;
         }
-        // 'r' key on invite link row — regen link
+        // 'r' key on invite link row — regen (member/viewer) or mint-new (admin).
+        // Admin regen is semantically the same as mint since each admin link is
+        // single-use; we just mint and surface instead of asking for confirmation.
         if (input === 'r' && s.userRole === 'admin' && onLinkRow) {
             const linkIdx = sel - memberCount - 3;
             const role = linkRoles[linkIdx];
+            if (role === 'admin' && team) {
+                try {
+                    const link = await api.mintAdminInvite(team.team_id);
+                    dispatch({ type: 'OPEN_MODAL', modal: { kind: 'invite-link', role: 'admin', url: link.url } });
+                }
+                catch {
+                    showToast('Failed to mint admin invite', 'error');
+                }
+                return;
+            }
             dispatch({ type: 'OPEN_MODAL', modal: { kind: 'confirm-regen-link', role } });
             return;
         }
@@ -781,10 +873,13 @@ export default function App() {
             }
             return;
         }
-        // 'c' key on invite link row — copy link
+        // 'c' key on invite link row — copy link. Admin row has no persistent
+        // URL (admin invites are minted on demand) so 'c' is a no-op there.
         if (input === 'c' && s.userRole === 'admin' && onLinkRow) {
             const linkIdx = sel - memberCount - 3;
             const role = linkRoles[linkIdx];
+            if (role === 'admin')
+                return;
             const link = s.inviteLinks.find(l => l.role === role);
             if (link) {
                 copyToClipboard(link.url);
@@ -795,15 +890,34 @@ export default function App() {
             }
             return;
         }
-        // 'o' key on invite link row — open in browser
+        // 'o' key on invite link row — open in browser. Same as 'c', admin row
+        // has nothing to open since the link doesn't exist until minted.
         if (input === 'o' && s.userRole === 'admin' && onLinkRow) {
             const linkIdx = sel - memberCount - 3;
             const role = linkRoles[linkIdx];
+            if (role === 'admin')
+                return;
             const link = s.inviteLinks.find(l => l.role === role);
             if (link)
                 openBrowser(link.url);
             return;
         }
+        // Enter on the admin invite row — mint a fresh short-lived single-use
+        // link and surface it via the invite-link modal (copy/open affordances).
+        if (key.return && s.userRole === 'admin' && onLinkRow) {
+            const linkIdx = sel - memberCount - 3;
+            const role = linkRoles[linkIdx];
+            if (role === 'admin' && team) {
+                try {
+                    const link = await api.mintAdminInvite(team.team_id);
+                    dispatch({ type: 'OPEN_MODAL', modal: { kind: 'invite-link', role: 'admin', url: link.url } });
+                }
+                catch {
+                    showToast('Failed to mint admin invite', 'error');
+                }
+                return;
+            }
+        }
         // 'd' key (admin) — delete team
         if (input === 'd' && s.userRole === 'admin') {
             if (team) {
@@ -1032,14 +1146,13 @@ export default function App() {
         }
         // Integration key creation wizard
         if (modal.kind === 'create-integration-key') {
-            const adminProjects = adminScopableProjects(s);
+            // Silo rule: once one project is selected, only same-entity projects
+            // are reachable. Filter here so index arithmetic in the picker stays
+            // consistent with what the Modal renders.
+            const adminProjects = filterToSameEntity(adminScopableProjects(s), modal.selectedProjectIds, s.user?.id ?? null);
             if (modal.step === 'name') {
                 if (key.return && modal.input.trim().length > 0) {
-                    if (adminProjects.length === 0) {
-                        showInlineError('no projects you can scope an integration key to', 3000);
-                        return;
-                    }
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'project' } });
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'agent' } });
                 }
                 else if (key.backspace || key.delete) {
                     dispatch({ type: 'OPEN_MODAL', modal: { ...modal, input: modal.input.slice(0, -1) } });
@@ -1052,75 +1165,131 @@ export default function App() {
                 }
                 return;
             }
-            if (modal.step === 'project') {
-                if (adminProjects.length === 0)
-                    return;
-                if (key.upArrow) {
-                    const i = Math.max(0, modal.projectSelectedIdx - 1);
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, projectSelectedIdx: i, projectId: adminProjects[i].project_id } });
+            if (modal.step === 'agent') {
+                if (key.return) {
+                    if (adminProjects.length === 0) {
+                        showInlineError('no projects you can scope a key to', 3000);
+                        return;
+                    }
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'projects' } });
                 }
-                else if (key.downArrow) {
-                    const i = Math.min(adminProjects.length - 1, modal.projectSelectedIdx + 1);
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, projectSelectedIdx: i, projectId: adminProjects[i].project_id } });
+                else if (key.backspace || key.delete) {
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, agentName: modal.agentName.slice(0, -1) } });
                 }
-                else if (key.return && modal.projectId) {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'role' } });
+                else if (input === ' ') {
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, agentName: modal.agentName + ' ' } });
+                }
+                else if (input.length === 1 && !key.ctrl && !key.meta) {
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, agentName: modal.agentName + input } });
                 }
                 return;
             }
-            if (modal.step === 'role') {
-                const roles = ['admin', 'member', 'viewer'];
+            if (modal.step === 'projects') {
+                if (adminProjects.length === 0)
+                    return;
                 if (key.upArrow) {
-                    const i = Math.max(0, modal.roleSelectedIdx - 1);
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, roleSelectedIdx: i, role: roles[i] } });
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, projectSelectedIdx: Math.max(0, modal.projectSelectedIdx - 1) } });
                 }
                 else if (key.downArrow) {
-                    const i = Math.min(2, modal.roleSelectedIdx + 1);
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, roleSelectedIdx: i, role: roles[i] } });
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, projectSelectedIdx: Math.min(adminProjects.length - 1, modal.projectSelectedIdx + 1) } });
                 }
-                else if (key.return) {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'tools' } });
+                else if (input === ' ') {
+                    const p = adminProjects[modal.projectSelectedIdx];
+                    if (p) {
+                        const next = new Set(modal.selectedProjectIds);
+                        if (next.has(p.project_id))
+                            next.delete(p.project_id);
+                        else
+                            next.add(p.project_id);
+                        dispatch({ type: 'OPEN_MODAL', modal: { ...modal, selectedProjectIds: next } });
+                    }
+                }
+                else if (key.return && modal.selectedProjectIds.size > 0) {
+                    // Initialize default scopes for new projects (all actions on)
+                    const scopes = new Map(modal.projectScopes);
+                    for (const pid of modal.selectedProjectIds) {
+                        if (!scopes.has(pid)) {
+                            scopes.set(pid, new Set([...ALL_KEY_ACTIONS]));
+                        }
+                    }
+                    // Remove scopes for deselected projects
+                    for (const pid of scopes.keys()) {
+                        if (!modal.selectedProjectIds.has(pid))
+                            scopes.delete(pid);
+                    }
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'permissions', projectScopes: scopes, permProjectIdx: 0, permActionIdx: 0 } });
                 }
                 return;
             }
-            if (modal.step === 'tools') {
-                if (key.upArrow) {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, toolsSelectedIdx: Math.max(0, modal.toolsSelectedIdx - 1) } });
+            if (modal.step === 'permissions') {
+                const selectedProjects = adminProjects.filter(p => modal.selectedProjectIds.has(p.project_id));
+                const projectCount = selectedProjects.length;
+                if (projectCount === 0)
+                    return;
+                if (key.tab) {
+                    // tab cycles through projects
+                    const next = (modal.permProjectIdx + 1) % projectCount;
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, permProjectIdx: next, permActionIdx: 0 } });
+                }
+                else if (key.upArrow) {
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, permProjectIdx: Math.max(0, modal.permProjectIdx - 1), permActionIdx: 0 } });
                 }
                 else if (key.downArrow) {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, toolsSelectedIdx: Math.min(KNOWN_TOOL_NAMES.length - 1, modal.toolsSelectedIdx + 1) } });
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, permProjectIdx: Math.min(projectCount - 1, modal.permProjectIdx + 1), permActionIdx: 0 } });
+                }
+                else if (key.leftArrow) {
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, permActionIdx: Math.max(0, modal.permActionIdx - 1) } });
+                }
+                else if (key.rightArrow) {
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, permActionIdx: Math.min(ALL_KEY_ACTIONS.length - 1, modal.permActionIdx + 1) } });
                 }
                 else if (input === ' ') {
-                    const t = KNOWN_TOOL_NAMES[modal.toolsSelectedIdx];
-                    const next = modal.allowedTools.includes(t)
-                        ? modal.allowedTools.filter(x => x !== t)
-                        : [...modal.allowedTools, t];
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, allowedTools: next } });
+                    const p = selectedProjects[modal.permProjectIdx];
+                    if (p) {
+                        const action = ALL_KEY_ACTIONS[modal.permActionIdx];
+                        const scopes = new Map(modal.projectScopes);
+                        const actions = new Set(scopes.get(p.project_id) ?? []);
+                        if (actions.has(action))
+                            actions.delete(action);
+                        else
+                            actions.add(action);
+                        scopes.set(p.project_id, actions);
+                        dispatch({ type: 'OPEN_MODAL', modal: { ...modal, projectScopes: scopes } });
+                    }
                 }
                 else if (key.return) {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'agent' } });
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'limits' } });
                 }
                 return;
             }
-            if (modal.step === 'agent') {
+            if (modal.step === 'limits') {
                 if (key.return) {
                     dispatch({ type: 'OPEN_MODAL', modal: { ...modal, step: 'confirm' } });
                 }
-                else if (key.backspace || key.delete) {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, agentName: modal.agentName.slice(0, -1) } });
+                else if (key.tab) {
+                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, limitsField: modal.limitsField === 'expiry' ? 'ops' : 'expiry' } });
                 }
-                else if (input === ' ') {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, agentName: modal.agentName + ' ' } });
+                else if (key.backspace || key.delete) {
+                    if (modal.limitsField === 'expiry') {
+                        dispatch({ type: 'OPEN_MODAL', modal: { ...modal, expiresInDays: modal.expiresInDays.slice(0, -1) } });
+                    }
+                    else {
+                        dispatch({ type: 'OPEN_MODAL', modal: { ...modal, opsLimit: modal.opsLimit.slice(0, -1) } });
+                    }
                 }
-                else if (input.length === 1 && !key.ctrl && !key.meta) {
-                    dispatch({ type: 'OPEN_MODAL', modal: { ...modal, agentName: modal.agentName + input } });
+                else if (/^[0-9]$/.test(input)) {
+                    if (modal.limitsField === 'expiry') {
+                        dispatch({ type: 'OPEN_MODAL', modal: { ...modal, expiresInDays: modal.expiresInDays + input } });
+                    }
+                    else {
+                        dispatch({ type: 'OPEN_MODAL', modal: { ...modal, opsLimit: modal.opsLimit + input } });
+                    }
                 }
                 return;
             }
             if (modal.step === 'confirm') {
                 if (input === 'y') {
                     await confirmModal(modal);
-                    // confirmModal handles the modal transition (closes on error, opens key-created on success)
                 }
                 else if (input === 'n') {
                     dispatch({ type: 'CLOSE_MODAL' });
@@ -1212,30 +1381,23 @@ export default function App() {
                             return;
                         }
                     }
-                    if (shouldRequireConsensus(stateRef.current) && modal.currentRole === 'admin' && newRole !== 'admin') {
-                        const team = getActiveTeam(stateRef.current);
-                        if (team) {
-                            try {
-                                await api.initiateApproval(team.team_id, 'demote_admin', `demote ${modal.targetEmail} from admin`, modal.targetUserId);
-                                const approvals = await api.listApprovals(team.team_id);
-                                dispatch({ type: 'SET_PENDING_APPROVALS', approvals });
-                                dispatch({ type: 'CLOSE_MODAL' });
-                                showToast('Approval requested', 'info');
-                            }
-                            catch {
-                                showToast('Failed to request approval', 'error');
-                                dispatch({ type: 'CLOSE_MODAL' });
-                            }
-                            return;
-                        }
-                    }
                     const changeTeam = getActiveTeam(s);
                     if (changeTeam) {
                         try {
-                            await api.changeTeamRole(changeTeam.team_id, modal.targetUserId, newRole);
-                            const members = await api.listTeamMembers(changeTeam.team_id);
-                            dispatch({ type: 'SET_MEMBERS', members });
-                            showToast('Role updated', 'success');
+                            // Server decides whether consensus applies — if so, it returns
+                            // 202 with a pending_approval object; otherwise the role change
+                            // applies immediately. We don't branch client-side.
+                            const resp = await api.changeTeamRole(changeTeam.team_id, modal.targetUserId, newRole);
+                            if (resp.pending_approval) {
+                                const approvals = await api.listApprovals(changeTeam.team_id);
+                                dispatch({ type: 'SET_PENDING_APPROVALS', approvals });
+                                showToast('Role change proposed — waiting for majority', 'info');
+                            }
+                            else {
+                                const members = await api.listTeamMembers(changeTeam.team_id);
+                                dispatch({ type: 'SET_MEMBERS', members });
+                                showToast('Role updated', 'success');
+                            }
                         }
                         catch {
                             showToast('Failed to update role', 'error');
@@ -1283,6 +1445,26 @@ export default function App() {
             }
             else if (key.return) {
                 const role = roles[modal.selected];
+                const team = getActiveTeam(s);
+                if (!team) {
+                    dispatch({ type: 'CLOSE_MODAL' });
+                    showToast('No team selected', 'error');
+                    return;
+                }
+                if (role === 'admin') {
+                    // Admin invites are minted on the fly — short-lived, single-use.
+                    // No persistent link in state.inviteLinks; each invite is fresh.
+                    try {
+                        const link = await api.mintAdminInvite(team.team_id);
+                        dispatch({ type: 'CLOSE_MODAL' });
+                        dispatch({ type: 'OPEN_MODAL', modal: { kind: 'invite-link', role, url: link.url } });
+                    }
+                    catch {
+                        dispatch({ type: 'CLOSE_MODAL' });
+                        showToast('Failed to mint admin invite', 'error');
+                    }
+                    return;
+                }
                 const link = s.inviteLinks.find(l => l.role === role);
                 if (link) {
                     dispatch({ type: 'CLOSE_MODAL' });
@@ -1476,16 +1658,19 @@ export default function App() {
                 return false;
             const slug = modal.input.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
             try {
-                dispatch({ type: 'SET_OPERATION', operation: 'Creating team' });
-                const team = await api.createTeam(modal.input, slug);
-                dispatch({ type: 'CLOSE_MODAL' });
-                dispatch({ type: 'OPEN_MODAL', modal: { kind: 'create-team-project', teamId: team.id, teamName: modal.input, input: '' } });
+                dispatch({ type: 'SET_OPERATION', operation: 'Opening team checkout' });
+                // Team creation is gated on a team subscription — we hand the user
+                // to Stripe checkout; the webhook creates the team + sub atomically
+                // on payment. The new team appears on the next me() refresh.
+                const { checkout_url } = await api.createTeam(modal.input, slug);
+                if (checkout_url)
+                    openBrowser(checkout_url);
                 dispatch({ type: 'SET_OPERATION', operation: null });
-                return true; // chained to create-team-project — caller must not CLOSE_MODAL
+                showToast('Complete checkout in your browser — team will appear after payment', 'info');
             }
             catch {
                 dispatch({ type: 'SET_OPERATION', operation: null });
-                showToast('Failed to create team', 'error');
+                showToast('Failed to start team checkout', 'error');
             }
             return false;
         }
@@ -1512,19 +1697,23 @@ export default function App() {
             return false;
         }
         if (modal.kind === 'create-integration-key') {
-            // Only the confirm step submits — earlier steps just advance via OPEN_MODAL.
             if (modal.step !== 'confirm')
                 return false;
-            if (!modal.input.trim() || !modal.projectId)
+            if (!modal.input.trim() || modal.selectedProjectIds.size === 0)
                 return false;
             try {
                 dispatch({ type: 'SET_OPERATION', operation: 'Creating key' });
+                const projects = [...modal.selectedProjectIds].map(pid => ({
+                    project_id: pid,
+                    allowed_actions: [...(modal.projectScopes.get(pid) ?? [])],
+                }));
                 const result = await api.createApiKey({
                     kind: 'integration',
                     name: modal.input.trim(),
-                    projects: [{ project_id: modal.projectId, role: modal.role }],
-                    ...(modal.allowedTools.length > 0 ? { allowed_tools: modal.allowedTools } : {}),
+                    projects,
                     ...(modal.agentName.trim() ? { default_agent_name: modal.agentName.trim() } : {}),
+                    ...(modal.expiresInDays ? { expires_in_days: parseInt(modal.expiresInDays, 10) } : {}),
+                    ...(modal.opsLimit ? { ops_limit: parseInt(modal.opsLimit, 10) } : {}),
                 });
                 dispatch({ type: 'SET_OPERATION', operation: null });
                 const integrationKeys = stateRef.current.userRole === 'admin' && stateRef.current.activeProjectId
@@ -1602,27 +1791,25 @@ export default function App() {
             case 'confirm-clear': {
                 const project = getActiveProject(s);
                 if (project && modal.input === project.slug) {
-                    if (shouldRequireConsensus(s)) {
-                        const team = getActiveTeam(s);
-                        if (team) {
-                            try {
-                                await api.initiateApproval(team.team_id, 'clear_memories', `clear all contributions from "${project.slug}"`, projectId);
+                    try {
+                        dispatch({ type: 'SET_OPERATION', operation: 'Clearing contributions' });
+                        // Server gates this behind consensus for team projects. If the
+                        // response includes pending_approval, the action is queued.
+                        const resp = await api.clearMemories(projectId);
+                        if (resp.pending_approval) {
+                            const team = getActiveTeam(s);
+                            if (team) {
                                 const approvals = await api.listApprovals(team.team_id);
                                 dispatch({ type: 'SET_PENDING_APPROVALS', approvals });
-                                showToast('Approval requested', 'info');
-                            }
-                            catch {
-                                showToast('Failed to request approval', 'error');
                             }
-                            break;
+                            dispatch({ type: 'SET_OPERATION', operation: null });
+                            showToast('Clear proposed — waiting for majority', 'info');
+                        }
+                        else {
+                            dispatch({ type: 'SET_MEMORIES', memories: [], total: 0 });
+                            dispatch({ type: 'SET_OPERATION', operation: null });
+                            showToast('All contributions cleared', 'success');
                         }
-                    }
-                    try {
-                        dispatch({ type: 'SET_OPERATION', operation: 'Clearing contributions' });
-                        await api.clearMemories(projectId);
-                        dispatch({ type: 'SET_MEMORIES', memories: [], total: 0 });
-                        dispatch({ type: 'SET_OPERATION', operation: null });
-                        showToast('All contributions cleared', 'success');
                     }
                     catch {
                         dispatch({ type: 'SET_OPERATION', operation: null });
@@ -1634,21 +1821,6 @@ export default function App() {
             case 'confirm-delete': {
                 const project = getActiveProject(s);
                 if (project && modal.input === project.slug) {
-                    if (shouldRequireConsensus(s)) {
-                        const team = getActiveTeam(s);
-                        if (team) {
-                            try {
-                                await api.initiateApproval(team.team_id, 'delete_project', `delete project "${project.slug}"`, projectId);
-                                const approvals = await api.listApprovals(team.team_id);
-                                dispatch({ type: 'SET_PENDING_APPROVALS', approvals });
-                                showToast('Approval requested', 'info');
-                            }
-                            catch {
-                                showToast('Failed to request approval', 'error');
-                            }
-                            break;
-                        }
-                    }
                     try {
                         dispatch({ type: 'SET_OPERATION', operation: 'Deleting project' });
                         await api.deleteProject(projectId);
@@ -1791,24 +1963,16 @@ export default function App() {
             case 'confirm-delete-team': {
                 const teamForDelete = getActiveTeam(s);
                 if (teamForDelete && modal.input === modal.slug) {
-                    if (shouldRequireConsensus(s)) {
-                        const team = getActiveTeam(s);
-                        if (team) {
-                            try {
-                                await api.initiateApproval(team.team_id, 'delete_team', `delete team "${team.name}"`);
-                                const approvals = await api.listApprovals(team.team_id);
-                                dispatch({ type: 'SET_PENDING_APPROVALS', approvals });
-                                showToast('Approval requested', 'info');
-                            }
-                            catch {
-                                showToast('Failed to request approval', 'error');
-                            }
-                            break;
-                        }
-                    }
                     try {
                         dispatch({ type: 'SET_OPERATION', operation: 'Deleting team' });
-                        await api.deleteTeam(teamForDelete.team_id);
+                        const resp = await api.deleteTeam(teamForDelete.team_id);
+                        if (resp.pending_approval) {
+                            const approvals = await api.listApprovals(teamForDelete.team_id);
+                            dispatch({ type: 'SET_PENDING_APPROVALS', approvals });
+                            dispatch({ type: 'SET_OPERATION', operation: null });
+                            showToast('Team deletion proposed — waiting for majority', 'info');
+                            break;
+                        }
                         const me = await api.me();
                         dispatch({ type: 'SET_USER_DATA', me });
                         dispatch({ type: 'SWITCH_TAB', tab: 'knowledge' });
@@ -1939,11 +2103,12 @@ function hasBillingBanner(state) {
 function deriveFlatProjectsFromMe(me) {
     const list = [];
     for (const p of me.personal_projects) {
-        list.push({ project_id: p.project_id, slug: p.slug, name: p.name, created_at: p.created_at, owner: { kind: 'personal' } });
+        list.push({ project_id: p.project_id, slug: p.slug, name: p.name, created_at: p.created_at, locked: p.locked ?? false, owner: { kind: 'personal' } });
     }
     for (const team of me.teams) {
+        const teamCanceled = team.subscription?.status === 'canceled';
         for (const p of team.projects) {
-            list.push({ project_id: p.project_id, slug: p.slug, name: p.name, created_at: p.created_at, owner: { kind: 'team', teamId: team.team_id, teamName: team.name, teamSlug: team.slug } });
+            list.push({ project_id: p.project_id, slug: p.slug, name: p.name, created_at: p.created_at, locked: teamCanceled, owner: { kind: 'team', teamId: team.team_id, teamName: team.name, teamSlug: team.slug } });
         }
     }
     return list;